ETSITS131 121 V4.13.0 



(2005-10) 



Technical Specification 



Universal Mobile Telecommunications System (UMTS); 

UlCC-terminal interface; 
Universal Subscriber Identity Module (USIM) 

application test specification 
(3GPP TS 31.121 version 4.13.0 Release 4) 



35$ 




3GPP TS 31.121 version 4.13.0 Release 4 1 ETSI TS 131 121 V4.13.0 (2005-10) 



Reference 



RTS/TSGC-0631121v4dO 
Keywords 



UMTS 



ETSI 

650 Route des Lucioles 
F-06921 Sophia Antipolis Cedex - FRANCE 

Tel. : +33 4 92 94 42 00 Fax: +33 4 93 65 47 1 6 

Siret N ° 348 623 562 0001 7 - NAF 742 C 
Association a but non lucratif enregistree a la 
Sous-Prefecture de Grasse (06) N° 7803/88 



Important notice 



Individual copies of the present document can be downloaded from: 
http://www.etsi.org 

The present document may be made available in more than one electronic version or in print. In any case of existing or 

perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). 

In case of dispute, the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive 

within ETSI Secretariat. 

Users of the present document should be aware that the document may be subject to revision or change of status. 

Information on the current status of this and other ETSI documents is available at 

http://portal.etsi.org/tb/status/status.asp 

If you find errors in the present document, please send your comment to one of the following services: 

http://portal.etsi.org/chaircor/ETSI support.asp 

Copyright Notification 

No part may be reproduced except as authorized by written permission. 
The copyright and the foregoing restriction extend to reproduction in all media. 

© European Telecommunications Standards Institute 2005. 
All rights reserved. 

DECT™, PLUGTESTS™ and UMTS™ are Trade Marks of ETSI registered for the benefit of its Members. 
TIPHON™ and the TIPHON logo are Trade Marks currently being registered by ETSI for the benefit of its Members. 
3GPP™ is a Trade Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. 



ETSI 



3GPP TS 31.121 version 4.13.0 Release 4 2 ETSI TS 131 121 V4.13.0 (2005-10) 



Intellectual Property Rights 



IPRs essential or potentially essential to the present document may have been declared to ETSI. The information 
pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found 
in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in 
respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web 
server ( http://webapp.etsi.org/IPR/home.asp ). 

Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee 
can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web 
server) which are, or may be, or may become, essential to the present document. 



Foreword 

This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). 

The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or 
GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. 

The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under 
http ://webapp . etsi.org/kev/queryform. asp . 



ETSI 



3GPP TS 31.121 version 4.13.0 Release 4 3 ETSI TS 131 121 V4.13.0 (2005-10) 



Contents 



Intellectual Property Rights 2 

Foreword 2 

Foreword 11 

Introduction 11 

1 Scope 12 

2 References 12 

3 Definitions, symbols, abbreviations and coding 13 

3.1 Definitions 13 

3.2 Symbols 14 

3.3 Abbreviations 14 

3.4 Coding Conventions 15 

3.5 Generic procedures for UTRAN 15 

4 Default Values 16 

4.1 Definition of default values for USIM-Terminal interface testing (Default UICC) 16 

4.1.1 Values of the EF's (Default UICC) 16 

4.1.1.1 EF IMS i(IMSI) 16 

4.1.1.2 EF AD (Administrative Data) 16 

4.1.1.3 EF LO ci (Location Information) 16 

4.1.1.4 EF Keys (Ciphering and Integrity Keys) 17 

4.1.1.5 EF Keys ps (Ciphering and Integrity Keys for Packet Switched domain) 17 

4.1.1.6 EFacc (Access Control Class) 17 

4.1.1.7 EF FPLMN (Forbidden PLMNs) 17 

4.1.1.8 EF UST (USIM Service Table) 17 

4.1.1.9 EF EST (Enable Service Table) 18 

4.1.1.10 EFadn (Abbreviated Dialling Number) 18 

4.1.1.11 EF PLMNwACT (User Controlled PLMN Selector with Access Technology) 18 

4.1.1.12 EFqplmnwact (Operator Controlled PLMN Selector with Access Technology) 19 

4.1.1.13 Void 19 

4.1.1.14 PIN 19 

4.1.1.15 PIN2 19 

4.1.1.16 Unblock PIN 20 

4.1.1.17 Unblock PIN2 20 

4.1.1.18 Other Values of the USIM 20 

4.1.1.19 EFpsLoci (Packet Switch Location Information) 20 

4.1.1.20 Universal PIN 20 

4.1.1.21 Unblock Universal PIN 20 

4.2 Definition of FDN UICC 21 

4.2.1 Values of the EF's (FDN UICC) 21 

4.2.1.1 EFust (USIM Service Table) 21 

4.2.1.2 EF ES T (Enable Service Table) 21 

4.2.1.3 EF FDN (Fixed Dialling Numbers) 21 

4.2.1.4 EF ECC (Emergency Call Codes) 22 

4.2.1.5 Other Values of the USIM 22 

5 Subscription related tests 23 

5.1 IMSI / TMSI handling 23 

5.1.1 UE identification by short IMSI 23 

5.1.1.1 Definition and applicability 23 

5.1.1.2 Conformance requirement 23 

5.1.1.3 Test purpose 23 

5.1.1.4 Method of test 23 

5.1.1.4.1 Initial conditions 23 

5.1.1.4.2 Procedure 23 



ETSI 



3GPP TS 31.121 version 4.13.0 Release 4 4 ETSI TS 131 121 V4.13.0 (2005-10) 

Acceptance criteria 24 

UE identification by short IMSI using a 2 digit MNC 24 

Definition and applicability 24 

Conformance requirement 24 

Test purpose 24 

Method of test 24 

Initial conditions 24 

Procedure 25 

Acceptance criteria 25 

UE identification by "short" TMSI 25 

Definition and applicability 25 

Conformance requirement 25 

Test purpose 25 

Method of test 26 

Initial conditions 26 

Procedure 26 

Acceptance criteria 26 

UE identification by "long" TMSI 26 

Definition and applicability 26 

Conformance requirement 26 

Test purpose 27 

Method of test 27 

Initial conditions 27 

Procedure 27 

Acceptance criteria 27 

UE identification by long IMSI, TMSI updating and key set identifier assignment 28 

Definition and applicability 28 

Conformance requirement 28 

Test purpose 28 

Method of test 29 

Initial conditions 29 

Procedure 29 

Acceptance criteria 29 

Access Control handling 30 

Access Control information handling 30 

Definition and applicability 30 

Conformance requirement 30 

Test purpose 31 

Method of test 31 

Initial conditions 31 

Coding details 31 

Procedure 32 

Acceptance criteria 32 

Security related Tests 39 

PIN handling 39 

Entry of PIN 39 

Definition and applicability 39 

Conformance requirement 39 

Test purpose 39 

Method of test 39 

Initial conditions 39 

Procedure 39 

Acceptance criteria 39 

Change of PIN 40 

Definition and applicability 40 

Conformance requirement 40 

Test purpose 40 

Method of test 40 

Initial conditions 40 

Procedure 40 

Acceptance criteria 40 



ETSI 



5.1.1.5 


5.1.2 


5.1.2.1 


5.1.2.2 


5.1.2.3 


5.1.2.4 


5.1.2.4.1 


5.1.2.4.2 


5.1.2.5 


5.1.3 


5.1.3.1 


5.1.3.2 


5.1.3.3 


5.1.3.4 


5.1.3.4.1 


5.1.3.4.2 


5.1.3.5 


5.1.4 


5.1.4.1 


5.1.4.2 


5.1.4.3 


5.1.4.4 


5.1.4.4.1 


5.1.4.4.2 


5.1.4.5 


5.1.5 


5.1.5.1 


5.1.5.2 


5.1.5.3 


5.1.5.4 


5.1.5.4.1 


5.1.5.4.2 


5.1.5.5 


5.2 


5.2.1 


5.2.1.1 


5.2.1.2 


5.2.1.3 


5.2.1.4 


5.2.1.4.1 


5.2.1.4.2 


5.2.1.4.3 


5.2.1.5 


6 St 


6.1 


6.1.1 


6.1 


1.1 


6.1 


1.2 


6.1 


1.3 


6.1 


1.4 


6.1 


1.4.1 


6.1 


1.4.2 


6.1 


1.5 


6.1 


2 


6.1 


2.1 


6.1 


2.2 


6.1 


2.3 


6.1 


2.4 


6.1 


2.4.1 


6.1 


2.4.2 


6.1 


2.5 



3GPP TS 31.121 version 4.13.0 Release 4 5 ETSI TS 131 121 V4.13.0 (2005-10) 

Unblock PIN 41 

Definition and applicability 41 

Conformance requirement 41 

Test purpose 41 

Method of test 41 

Initial conditions 41 

Procedure 41 

Acceptance criteria 41 

Entry of PIN2 42 

Definition and applicability 42 

Conformance requirement 42 

Test purpose 42 

Method of test 42 

Initial conditions 42 

Procedure 42 

Acceptance criteria 42 

Change of PIN2 43 

Definition and applicability 43 

Conformance requirement 43 

Test purpose 43 

Method of test 43 

Initial conditions 43 

Procedure 43 

Acceptance criteria 43 

Unblock PIN2 44 

Definition and applicability 44 

Conformance requirement 44 

Test purpose 44 

Method of test 44 

Initial conditions 44 

Procedure 44 

Acceptance criterias 45 

Replacement of PIN 45 

Definition and applicability 45 

Conformance requirement 45 

Test purpose 45 

Method of test 45 

Initial conditions 45 

Procedure 45 

Acceptance criteria 46 

Change of Universal PIN 46 

Definition and applicability 46 

Conformance requirement 46 

Test purpose 46 

Method of test 47 

Initial conditions 47 

Procedure 47 

Acceptance criteria 47 

Unblock Universal PIN 47 

Definition and applicability 47 

Conformance requirement 47 

Test purpose 47 

Method of test 48 

Initial conditions 48 

Procedure 48 

Acceptance criteria 48 

Entry of PIN on multi-verification capable UICCs 48 

Definition and applicability 48 

Conformance requirement 48 

Test purpose 49 

Method of test 49 

Initial conditions 49 



ETSI 



6.1.3 


6.1.3.1 


6.1.3.2 


6.1.3.3 


6.1.3.4 


6.1.3.4.1 


6.1.3.4.2 


6.1.3.5 


6.1.4 


6.1.4.1 


6.1.4.2 


6.1.4.3 


6.1.4.4 


6.1.4.4.1 


6.1.4.4.2 


6.1.4.5 


6.1.5 


6.1.5.1 


6.1.5.2 


6.1.5.3 


6.1.5.4 


6.1.5.4.1 


6.1.5.4.2 


6.1.5.5 


6.1.6 


6.1.6.1 


6.1.6.2 


6.1.6.3 


6.1.6.4 


6.1.6.4.1 


6.1.6.4.2 


6.1.6.5 


6.1.7 


6.1.7.1 


6.1.7.2 


6.1.7.3 


6.1.7.4 


6.1.7.4.1 


6.1.7.4.2 


6.1.7.5 


6.1.8 


6.1.8.1 


6.1.8.2 


6.1.8.3 


6.1.8.4 


6.1.8.4.1 


6.1.8.4.2 


6.1.8.5 


6.1.9 


6.1.9.1 


6.1.9.2 


6.1.9.3 


6.1.9.4 


6.1.9.4.1 


6.1.9.4.2 


6.1.9.5 


6.1.10 


6.1.10.1 


6.1.10.2 


6.1.10.3 


6.1.10.4 


6.1.10.4.1 



3GPP TS 31.121 version 4.13.0 Release 4 6 ETSI TS 131 121 V4.13.0 (2005-10) 



6.1 

6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.1 
6.2 
6.2 
6.2 
6.2 
6.2 
6.2 
6.2 
6.2 
6.2 
6.2 
6.2 
6.2 



10.4.2 Procedure 49 

10.5 Acceptance criteria 50 

11 Change of PIN on multi-verification capable UICCs 50 

11.1 Definition and applicability 50 

11.2 Conformance requirement 50 

11.3 Test purpose 50 

11.4 Method of test 50 

11.4.1 Initial conditions 50 

11.4.2 Procedure 51 

11.5 Acceptance criteria 51 

12 Unblock PIN on multi-verification capable UICCs 51 

12.1 Definition and applicability 51 

12.2 Conformance requirement 51 

12.3 Test purpose 52 

12.4 Method of test 52 

12.4.1 Initial conditions 52 

12.4.2 Procedure 53 

12.5 Acceptance criteria 53 

13 Entry of PIN2 on multi-verification capable UICCs 53 

13.1 Definition and applicability 53 

13.2 Conformance requirement 53 

13.3 Test purpose 53 

13.4 Method of test 54 

13.4.1 Initial conditions 54 

13.4.2 Procedure 54 

13.5 Acceptance criteria 54 

14 Change of PIN2 on multi-verification capable UICCs 55 

14.1 Definition and applicability 55 

14.2 Conformance requirement 55 

14.3 Test purpose 55 

14.4 Method of test 55 

14.4.1 Initial conditions 55 

14.4.2 Procedure 56 

14.5 Acceptance criteria 56 

15 Unblock PIN2 on multi-verification capable UICCs 56 

15.1 Definition and applicability 56 

15.2 Conformance requirement 57 

15.3 Test purpose 57 

15.4 Method of test 57 

15.4.1 Initial conditions 57 

15.4.2 Procedure 58 

15.5 Acceptance criterias 58 

16 Replacement of PIN with key reference "07" 58 

16.1 Definition and applicability 58 

16.2 Conformance requirement 58 

16.3 Test purpose 59 

16.4 Method of test 59 

16.4.1 Initial conditions 59 

16.4.2 Procedure 59 

16.5 Acceptance criteria 60 

Fixed Dialling Numbers (FDN) handling 60 

1 Terminal and USIM with FDN enabled, EF ADN readable and updateable 60 

1.1 Definition and applicability 60 

1.2 Conformance requirement 60 

1.3 Test purpose 61 

1.4 Method of test 61 

1.4.1 Initial conditions 61 

1.4.2 Procedure 61 

1.5 Acceptance criteria 62 

2 Terminal and USIM with FDN disabled 62 

2.1 Definition and applicability 62 

2.2 Conformance requirement 62 



ETSI 



3GPP TS 31.121 version 4.13.0 Release 4 7 ETSI TS 131 121 V4.13.0 (2005-10) 

6.2.2.3 Test purpose 62 

6.2.2.4 Method of test 63 

6.2.2.4.1 Initial conditions 63 

6.2.2.4.2 Procedure 63 

6.2.2.5 Acceptance criteria 63 

6.2.3 Enabling, disabling and updating of FDN 63 

6.2.3.1 Definition and applicability 63 

6.2.3.2 Conformance requirement 63 

6.2.3.3 Test purpose 64 

6.2.3.4 Method of test 64 

6.2.3.4.1 Initial conditions 64 

6.2.3.4.2 Procedure 64 

6.2.3.5 Acceptance criteria 64 

6.3 Void 65 

6.4 Advice of charge (AoC) handling 65 

6.4.1 AoC not supported by USIM 65 

6.4.1.1 Definition and applicability 65 

6.4.1.2 Conformance requirement 65 

6.4.1.3 Test purpose 65 

6.4.1.4 Method of test 66 

6.4.1.4.1 Initial conditions 66 

6.4.1.4.2 Procedure 66 

6.4.1.5 Acceptance criteria 66 

6.4.2 Maximum frequency of ACM updating 66 

6.4.2.1 Definition and applicability 66 

6.4.2.2 Conformance requirement 66 

6.4.2.3 Test purpose 67 

6.4.2.4 Method of test 67 

6.4.2.4.1 Initial conditions 67 

6.4.2.4.2 Procedure 67 

6.4.2.5 Acceptance criteria 69 

6.4.3 Call terminated when ACM greater than ACMmax 69 

6.4.3.1 Definition and applicability 69 

6.4.3.2 Conformance requirement 69 

6.4.3.3 Test purpose 69 

6.4.3.4 Method of test 69 

6.4.3.4.1 Initial conditions 69 

6.4.3.4.2 Procedure 70 

6.4.3.5 Acceptance criteria 71 

6.4.4 Response codes of increase command of ACM 72 

6.4.4.1 Definition and applicability 72 

6.4.4.2 Conformance requirement 72 

6.4.4.3 Test purpose 72 

6.4.4.4 Method of test 72 

6.4.4.4.1 Initial conditions 72 

6.4.4.4.2 Procedure 73 

6.4.4.5 Acceptance criteria 74 

7 PLMN related tests 75 

7.1 FPLMN handling 75 

7.1.1 Adding FPLMN to the Forbidden PLMN list 75 

7.1.1.1 Definition and applicability 75 

7.1.1.2 Conformance requirement 75 

7.1.1.3 Test purpose 76 

7.1.1.4 Method of test 76 

7.1.1.4.1 Initial conditions 76 

7.1.1.4.2 Procedure 77 

7.1.1.5 Acceptance criteria 79 

7.1.2 UE updating forbidden PLMNs 80 

7.1.2.1 Definition and applicability 80 

7.1.2.2 Conformance requirement 80 

7.1.2.3 Test purpose 81 



ETSI 



3GPP TS 31.121 version 4.13.0 Release 4 8 ETSI TS 131 121 V4.13.0 (2005-10) 

7.1.2.4 Method of test 81 

7.1.2.4.1 Initial conditions 81 

7.1.2.4.2 Procedure 81 

7.1.2.5 Acceptance criteria 82 

7.1.3 UE deleting forbidden PLMNs 82 

7.1.3.1 Definition and applicability 82 

7.1.3.2 Conformance requirement 83 

7.1.3.3 Test purpose 83 

7.1.3.4 Method of test 83 

7.1.3.4.1 Initial conditions 83 

7.1.3.4.2 Procedure 84 

7.1.3.5 Acceptance criteria 85 

7.2 User controlled PLMN selector handling 86 

7.2.1 UE updating the User controlled PLMN selector list 86 

7.2.1.1 Definition and applicability 86 

7.2.1.2 Conformance requirement 86 

7.2.1.3 Test purpose 86 

7.2.1.4 Method of test 86 

7.2.1.4.1 Initial conditions 86 

7.2.1.4.2 Procedure 86 

7.2.1.5 Acceptance criteria 86 

7.2.2 UE recognising the priority order of the User controlled PLMN selector list with the same access 
technology 87 

7.2.2.1 Definition and applicability 87 

7.2.2.2 Conformance requirement 87 

7.2.2.3 Test purpose 88 

7.2.2.4 Method of test 88 

7.2.2.4.1 Initial conditions 88 

7.2.2.4.2 Procedure 88 

7.2.2.5 Acceptance criteria 90 

7.2.3 UE recognising the priority order of the User controlled PLMN selector list using a ACT preference 90 

7.2.3.1 Definition and applicability 90 

7.2.3.2 Conformance requirement 91 

7.2.3.2.1 Test purpose 91 

7.2.3.3 Method of test 91 

7.2.3.3.1 Initial conditions 91 

7.2.3.3.2 Procedure 91 

7.2.3.4 Acceptance criteria 92 

7.2.4 Void 92 

7.3 Operator controlled PLMN selector handling 92 

7.3.1 UE recognising the priority order of the Operator controlled PLMN selector list 92 

7.3.1.1 Definition and applicability 92 

7.3.1.2 Conformance requirement 92 

7.3.1.3 Test purpose 92 

7.3.1.4 Method of test 93 

7.3.1.4.1 Initial conditions 93 

7.3.1.4.2 Procedure 94 

7.3.1.5 Acceptance criteria 95 

7.3.2 UE recognising the priority order of the User controlled PLMN selector over the Operator controlled 
PLMN selector list 96 

7.3.2.1 Definition and applicability 96 

7.3.2.2 Conformance requirement 96 

7.3.2.3 Test purpose 96 

7.3.2.4 Method of test 96 

7.3.2.4.1 Initial conditions 96 

7.3.2.4.2 Procedure 97 

7.3.2.5 Acceptance criteria 98 

7.4 Higher priority PLMN search handling 99 

7.4.1 UE recognising the search period of the Higher priority PLMN 99 

7.4.1.1 Definition and applicability 99 

7.4.1.2 Conformance requirement 99 

7.4.1.3 Test purpose 99 



ETSI 



3GPP TS 31.121 version 4.13.0 Release 4 9 ETSI TS 131 121 V4.13.0 (2005-10) 

7.4.1.4 Method of test 99 

7.4.1.4.1 Initial conditions 99 

7.4.1.4.2 Procedure 100 

7.4.1.5 Acceptance criteria 102 

7.4.2 GSM/UMTS dual mode UEs recognising the search period of the Higher priority PLMN 103 

7.4.2.1 Definition and applicability 103 

7.4.2.2 Conformance requirement 103 

7.4.2.3 Test purpose 103 

7.4.2.4 Method of test 103 

7.4.2.4.1 Initial conditions 103 

7.4.2.4.2 Procedure 104 

7.4.2.5 Acceptance criteria 106 

7.5 Void 107 

8 Subscription independent tests 107 

8.1 Phone book procedures 107 

8.1.1 Recognition of a previously changed phonebook 107 

8.1.1.1 Definition and applicability 107 

8.1.1.2 Conformance requirement 107 

8.1.1.3 Test purpose 107 

8.1.1.4 Method of test 107 

8.1.1.4.1 Initial conditions 107 

8.1.1.4.2 Procedure 108 

8.1.1.5 Acceptance criteria 108 

8.1.2 Update of the Phonebook Synchronisation Counter (PSC) 108 

8.1.2.1 Definition and applicability 108 

8.1.2.2 Conformance requirement 109 

8.1.2.3 Test purpose 109 

8.1.2.4 Method of test 109 

8.1.2.4.1 Initial conditions 109 

8.1.2.4.2 Procedure 109 

8.1.2.5 Acceptance criteria 110 

8.2 Short message handling report 110 

8.2.1 Correct storage of a SM on the USIM 110 

8.2.1.1 Definition and applicability 110 

8.2.1.2 Conformance requirement 110 

8.2.1.3 Test purpose 110 

8.2.1.4 Method of test Ill 

8.2.1.4.1 Initial conditions Ill 

8.2.1.4.2 Procedure 113 

8.2.1.5 Acceptance criteria 113 

8.2.2 Correct reading of a SM on the USIM 114 

8.2.2.1 Definition and applicability 114 

8.2.2.2 Conformance requirement 115 

8.2.2.3 Test purpose 115 

8.2.2.4 Method of test 115 

8.2.2.4.1 Initial conditions 115 

8.2.2.4.2 Procedure 116 

8.2.2.5 Acceptance criteria 116 

8.3 MMS related tests 116 

8.3.1 UE recognising the priority order of MMS Issuer Connectivity Parameters 116 

8.3.1.1 Definition and applicability 116 

8.3.1.2 Conformance requirement 117 

8.3.1.3 Test purpose 117 

8.3.1.4 Method of test 117 

8.3.1.4.1 Initial conditions 117 

8.3.1.4.2 Procedure 122 

8.3.1.5 Acceptance criteria 123 

8.3.2 UE recognising the priority order of MMS User Connectivity Parameters 123 

8.3.2.1 Definition and applicability 123 

8.3.2.2 Conformance requirement 123 

8.3.2.3 Test purpose 123 



ETSI 



3GPP TS 31.121 version 4.13.0 Release 4 10 ETSI TS 131 121 V4.13.0 (2005-10) 

8.3.2.4 Method of test 124 

8.3.2.4.1 Initial conditions 124 

8.3.2.4.2 Procedure 128 

8.3.2.5 Acceptance criteria 128 

8.3.3 UE recognising the priority order of MMS Issuer Connectivity Parameters over the MMS User 
Connectivity Parameters 128 

8.3.3.1 Definition and applicability 128 

8.3.3.2 Conformance requirement 129 

8.3.3.3 Test purpose 129 

8.3.3.4 Method of test 129 

8.3.3.4.1 Initial conditions 129 

8.3.3.4.2 Procedure 135 

8.3.3.5 Acceptance criteria 135 

8.3.4 Usage of MMS notification 135 

8.3.4.1 Definition and applicability 135 

8.3.4.2 Conformance requirement 135 

8.3.4.3 Test purpose 136 

8.3.4.4 Method of test 136 

8.3.4.4.1 Initial conditions 136 

8.3.4.4.2 Procedure 140 

8.3.4.5 Acceptance criteria 140 

Annex A (informative): Change history 142 

History 143 



ETSI 



3GPP TS 31.121 version 4.13.0 Release 4 11 ETSI TS 131 121 V4.13.0 (2005-10) 



Foreword 



id , 



This Technical Specification (TS) has been produced by the 3 Generation Partnership Project (3GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

x the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 



Introduction 



The present document defines the application test specification. 

The aim of the present document is to ensure interoperability between an UICC and a terminal independently of the 
respective manufacturer, card issuer or operator. The present document does not define any aspects related to the 
administrative management phase of the UICC. Any internal technical realisation of either the UICC or the Terminal is 
only specified where these are reflected over the interface. 

Application specific details for applications residing on an UICC are specified in the respective application specific 
documents. The logical and physical Characteristics of the UICC Terminal interface is specified in document 
TS 102 221 [5]. The Universal Subscriber Identity Module (USIM)-application for 3G telecommunication networks is 
specified in document TS 31.102 [4]. 
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1 Scope 

The present document provides the UICC (Universal IC Card)-Terminal Interface Conformance Test Specification 
between the 3 rd Generation Terminal and USIM (Universal Subscriber Identity Module) as an application on the UICC 
and the Terminal for 3G telecom network operation: 

- the default setting of the USIM; 

the applicability of each test case; 

the test configurations; 

the conformance requirement and reference to the core specifications; 

the test purposes; and 

a brief description of the test procedure and the specific acceptance criteria. 



References 



The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including 
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 

[I] Void 
[2] Void 

[3] 3GPP TS 23.038: "Alphabets and language-specific information". 

[4] 3GPP TS 3 1 . 102: "Characteristics of the USIM application". 

[5] ETSI TS 102 221 Release 4: "UICC-Terminal interface; Physical and logical characteristics". 

[6] 3GPP TS 22.01 1: "Service accessibility". 

[7] 3GPP TR 21.905: "Vocabulary for 3GPP Specifications". 

[8] 3GPP TS 22.024: "Description of Charge Advice Information (CAI)" . 

[9] 3GPP TS 23.086: "Advice of Charge (AoC) Supplementary Service - Stage 2". 

[10] 3GPP TS 24.086: "Advice of Charge (AoC) Supplementary Service - Stage 3". 

[II] 3GPP TS 22.101: "Service aspects; Service principles". 

[12] 3GPP TS 22.030: "Man-Machine Interface (MMI) of the User Equipment (UE)". 

[13] 3GPP TS 23.040: "Technical realization of the Short Message Service (SMS)". 

[14] 3GPP TS 23.003: "Numbering, Addressing and Identification". 

[15] 3GPP TS 44.018: "Mobile radio interface layer 3 specification; Radio Resource Control Protocol". 

[16] 3GPP TS 24.008: "Mobile radio interface Layer 3 specification; Core Network protocols; Stage 3". 
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[17] 3GPP TS 24.080: "Mobile radio Layer 3 supplementary service specification; Formats and 

coding". 

[18] 3GPP TS 22.086: "Advice of Charge (AoC) supplementary services; Stage 1". 

[19] 3GPP TS 21.1 1 1: "USIM and IC card requirements". 

[20] 3GPP TS 25.33 1 "Radio Resource Control (RRC); Protocol Specification" 

[21] 3GPP TS 34.108 "Common test environments for User Equipment (UE) conformance testing" 

[22] 3GPP TS 51.010-1 "Mobile Station (MS) conformance specification; Parti: Conformance 

specification" 

[23] 3GPP TS 23.140 "Multimedia Messaging Service (MMS); Functional description; Stage 2" 

3 Definitions, symbols, abbreviations and coding 

3.1 Definitions 

For the purposes of the present document, the following terms and definitions apply. 

Application DF (ADF): entry point to an application 

access conditions: set of security attributes associated with a file 

access technology: Radio Access Technology of the Terminal (e.g. UTRAN or GSM) 

application: consists of a set of security mechanisms, files, data and protocols (excluding transmission protocols) 

application protocol: set of procedures required by the application 

card session: link between the card and the external world starting with the ATR and ending with a subsequent reset or 
a deactivation of the card 

current directory: latest MF or DF or ADF selected 

current EF: latest EF selected 

data object: information coded as TLV objects, i.e. consisting of a Tag, a Length and a Value part 

Dedicated File (DF): file containing access conditions and, optionally, Elementary Files (EFs) or other Dedicated Files 
(DFs) 

directory: general term for MF, DF and ADF 

Elementary File (EF): file containing access conditions and data and no other files 

file: directory or an organised set of bytes or records in the UICC 

file identifier: 2 bytes which address a file in the UICC 

function: function contains a command and a response pair 

GSM session: that part of the card session dedicated to the GSM operation 

Master File (MF): unique mandatory file containing access conditions and optionally DFs and/or EFs 

MMS Relay/Server: MMS-specific network entity/application that is under the control of the MMS service provider 

NOTE: An MMS Relay/Server transfers messages, provides operations of the MMS that are specific or required 
by the mobile environment and provides (temporary and/or persistent) storage services to the MMS 
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MMS User Agent: application residing on a UE or an external device that performs MMS-specific operations on a 
user"s behalf 

normal USIM operation: relating to general, PIN related, 3G and or GSM security and subscription related procedures 

record: string of bytes within an EF handled as a single entity 

record number: number, which identifies a record within an EF 

record pointer: pointer, which addresses one record in an EF 

terminal: device into which a UICC can be inserted and which is capable of providing access to UMTS services to 
users, either alone or in conjunction with a UICC 

User Equipment (UE): terminal with one or several UMTS Subscriber Identity Module(s) (USIM) 

USIM session: USIM session is a selectable application session for a USIM application 



3.2 Symbols 



For the purposes of the present document, the following symbols apply: 



bx 
Bn 



Bit x of byte (leftmost bit is MSB) 
Byte No. n 



3.3 Abbreviations 

For the purposes of the present document, the following abbreviations apply: 



3G 


3 r Generation 


3GPP 


3 rd Generation Partnership Project 


ACC 


ACcess Class 


ACL 


APN Control List 


ACM 


Accumulated Call Meter 


ACMmax 


ACM maximal value 


ACT 


ACcess Technology 


ADF 


Application Dedicated File 


AoC 


Advice of Charge 


AoCC 


Advice of Charge Charging 


APN 


Access Point Name 


ATR 


Answer To Reset 


BCCH 


Broadcast Control Channel 


BCD 


Binary Coded Decimal 


BDN 


Barred Dialling Number 


CCI 


Capability / Configuration Identifier 


CCM 


Current Call Meter 


CK 


Cipher key 


CS 


Circuit switched 


CN 


Core Network 


DF 


Dedicated File 


EF 


Elementary File 


EMMI 


Electrical Man Machine Interface 


Ext n 


Extension n 


FDN 


Fixed Dialling Number 


FPLMN 


Forbidden PLMN 


GSM 


Global System for Mobile communications 


HPLMN 


Home PLMN 


ICC 


Integrated Circuit Card 


ID 


IDentifier 


IEC 


International Electrotechnical Commission 


IK 


Integrity key 


IMSI 


International Mobile Subscriber Identity 
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ISO International Organization for Standardization 

KSI Key Set Identifier 

LAC Location Area Code 

LAI Location Area Information 

LSB Least Significant Bit 

MCC Mobile Country Code 

MF Master File 

MM Multimedia Message 

MMI Man Machine Interface 

MMS Multimedia Messaging Service 

MNC Mobile Network Code 

MSB Most Significant Bit 

NAS Non Acess Stratum 

NPI Numbering Plan Identifier 

OFM Operational Feature Monitor 

OSI Open System Interconnection 

PS Packet switched 

PI Parameter 1 

P2 Parameter 2 

P3 Parameter 3 

PIN Personal Identification Number 

PLMN Public Land Mobile Network 

PS Packet switched 

RACH Random Access Channel 

RFU Reserved for Future Use 

RRC Radio Resource Control 

SFI Short File Identifier 

SS System Simulator (GSM) 

SM Short Message 

SMS Short Message Service 

TE Terminal Equipment 

TLV Tag Length Value 

TMSI Temporary Mobile Subscriber Identity 

TON Type Of Number 

UE User Equipment 

USIM Universal Subscriber Identity Module 

USS UMTS System Simulator 

UTRAN UMTS Terrestrial Radio Access Network 

VPLMN Visitor PLMN 



3.4 Coding Conventions 

For the purposes of the present document, the following coding conventions apply: 

All lengths are presented in bytes, unless otherwise stated. Each byte B is represented by eight bits b8 to bl, where b8 is 
the most significant bit (MSB) and bl is the least significant bit (LSB). In each representation, the leftmost bit is the 
MSB. 

In the UICC, all bytes specified as RFU shall be set to '00' and all bits specifies as RFU shall be set to '0'. If the GSM 
and/or USIM application exists on a UICC or is built on a generic telecommunications card, then other values may 
apply for the non- GSM or non-USIM applications. The values will be defined in the appropriate specifications for such 
cards and applications. These bytes and bits shall not be interpreted by a Terminal in a GSM or 3G session. 

The coding of all data objects in the present document is according to TS 102 221 [5], All data objects are BER-TLV 
except if otherwise defined. 



3.5 Generic procedures for UTRAN 



If a test case contains the statement "This test applies to Terminals accessing UTRAN", the procedures defined in 3GPP 
TS 34.108 [21], subclause 7.2 shall be the basis for all performed procedures during the test. The procedures in 
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subclause 7.2 describe the default behaviour of a conformant UE regarding the specified protocols to be used for 
UTRAN and the required procedures from the NAS. 

4 Default Values 

All tests defined in the subsequent clauses apply to Terminals using types specified in TS 102 221 [5] unless otherwise 
stated. 

The following sequence of tests confirms: 

a) the correct interpretation of data read from the USIM (Universal Subscriber Identification Module) by the 
Terminal; 

b) the correct writing of data to the USIM by the Terminal; 

c) the initiation of appropriate procedures by the Terminal; 

d) High level protocols. 

All tests apply to the USIM application on the UICC. 

A USIM simulator will be required as part of the USS. Alternatively, to perform the logical tests, USIMs programmed 
with specific data may be used. The USIM data is not defined within the initial conditions of the tests unless it differs 
from the default values defined below. 

4.1 Definition of default values for USIM-Terminal interface 
testing (Default UICC) 

A USIM containing the following default values is used for all tests of this present document unless otherwise stated. 
For each data item, the logical default values and the coding within the elementary files (EF) of the USIM follow. 

NOTE 1 : Bx represents byte x of the coding. 

NOTE 2: Unless otherwise defined, the coding values are hexadecimal. 



4.1 .1 Values of the EPs (Default UICC) 

4.1.1.1 EFimsi (IMSI) 

Logically: 2460813579 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


Hex 


06 


21 


64 


80 


31 


75 


F9 


FF 


FF 



4.1 .1 .2 EF AD (Administrative Data) 

Logically: Normal operation 

OFM to be deactivated by the Terminal 

MNC: 3 digit 

Coding: B1 B2 B3 B4 

Hex 00 00 00 03 



4.1 .1 .3 EFloci (Location Information) 

Logically: LAI-MCC: 246 

LAI-MNC: 081 
LAI-LAC: 0001 
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Coding: B1 
Hex FF 



TMSI: 



B2 
FF 



B3 
FF 



"FF .. FF" 

B4 
FF 



B5 
42 



B6 
16 



B7 
80 



B8 
00 



B9 
01 



B10 
FF 



B11 
00 



4.1.1.4 

Logically: 



Coding: 
Hex 



B1 
Ox 



EF Key s (Ciphering and Integrity Keys) 



Key Set Identifier KSI: 
Ciphering Keys CK: 
Integrity Keys IK: 



B2 
xx 



B3 

XX 



Ox 






XX 






XX 






B16 


B17 


B18 


XX 


XX 


XX 



B30 
xx 



B31 

xx 



B32 

XX 



B33 

XX 



4.1.1.5 

Logically: 



Coding: 
Hex 



B1 
Ox 



EF Ke ysPS (Ciphering and Integrity Keys for Packet Switched domain) 



Key Set Identifier KSI: 
Ciphering Keys CK: 
Integrity Keys IK: 



B2 
xx 



B3 

XX 



Ox 



XX 






XX 






B16 


B17 


B18 


XX 


XX 


XX 



B31 
xx 



B32 

xx 



B33 

XX 



4.1 .1 .6 EFacc (Access Control Class) 

Logically: One and only one access class from 0-9, e.g. class 7 for which the coding is "00 80". 

4.1 .1 .7 EFfplmn (Forbidden PLMNs) 

Besides of the 4 mandatory EFfp LM n 2 optional EF FPLM n are defined according to TS 31.102[4] subclause 4.2.16. 



Logically: 


PLMNl 
PLMN2 
PLMN3 
PLMN4 
PLMN5 
PLMN6 




234 001 (MCC MNC) 

234 002 

234 003 

234 004 

234 005 

234 006 














Coding: 
Hex 


B1 
32 

B13 
32 


B2 B3 
14 00 

B14 B15 
54 00 


B4 
32 

B16 
32 


B5 
24 

B17 

64 


B6 
00 

B18 
00 


B7 
32 


B8 
34 


B9 
00 


B10 
32 


B11 

44 


B12 
00 


4.1.1.8 




EFust (USIM Service Table) 
















Logically: 


Local PI 


lone Book available 

















User controlled PLMN selector available 

Fixed dialling numbers available 

Barred dialling numbers available 

The GSM Access available 

The Group Identifier level 1 and level 2 not available 

Service n 33 (Packed Switched Domain) shall be set to T' 

Enabled Services Table available 



Coding: 


B1 


B2 


B3 


B4 


B5 


binary 


xx1xxx11 


xxxx xxxx 


xxxx 1 xOO 


xxxx x1 XX 


XXXX XX 1 1 
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4.1.1.9 



The coding of EF UST shall conform with the capabilities of the USIM used. 



EFest (Enable Service Table) 



Logically: Fixed Dialling Numbers (FDN) disabled. 

Barred Dialling Numbers (BDN) disabled. 
APN Control list (ACL) disabled 

Coding: B1 
binary 0000 0000 



The coding of EF ES t shall conform with the capabilities of the USIM, unused Bits are set to '0'. 

4.1 .1 .1 EFadn (Abbreviated Dialling Number) 

Logically: 

At least 10 records, each non-empty record unique. 

Record 1: Length of alpha identifier: 32 characters; 







Alpha identifier: 




"ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEF"; 








Length of BCD number: 


"03"; 








TON and NPI: 




Telephony and Unknown; 








Dialled number: 




123; 








CCI: 




None; 




Record 1: 
Coding: 




Extl: 




None. 




B1 


B2 B3 


B32 


B33 B34 B35 B36 B37 B38 B39 ... 


B46 


Hex 


41 


42 43 


46 


03 81 21 F3 FF FF FF 


FF 



4.1.1.11 



EFrlmnwact (User Controlled PLMN Selector with Access Technology) 



Besides of the 8 mandatory PLMNwACT entries 4 optional PLMNwACT entries are defined according to TS 31.102[4] 
subclause 4.2.5. The Radio Access Technology identifier for the first two PLMN (1 st PLMN and 2 nd PLMN) are set to 
both UTRAN and GSM, all other PLMN to UTRAN only. 

Logically: 



1 st PLMN: 


244 081 (MCCMNC) 


1 st ACT: 


UTRAN 


2 nd PLMN: 


244 081 


2 nd ACT: 


GSM 


3 rd PLMN: 


244 082 


3 rd ACT: 


UTRAN 


4 th PLMN: 


244 082 


4 th ACT: 


GSM 


5 th PLMN: 


244 003 


5 th ACT: 


UTRAN 


6 th PLMN: 


244 004 


6 th ACT: 


UTRAN 


7 th PLMN: 


244 005 


7 th ACT: 


UTRAN 


8 th PLMN: 


244 006 


8 th ACT: 


UTRAN 


9 th PLMN: 


244 007 


9 th ACT: 


UTRAN 


10 th PLMN: 


244 008 


10 th ACT: 


UTRAN 


11 th PLMN: 


244 009 


11 th ACT: 


UTRAN 


12 th PLMN: 


244 010 


12 th ACT: 


UTRAN 
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Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


B13 


B14 


B15 


Hex 


42 


14 


80 


80 


00 


42 


14 


80 


00 


80 


42 


24 


80 


80 


00 




B16 


B17 


B18 


B19 


B20 


B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 




42 


24 


80 


00 


80 


42 


24 


00 


80 


00 


42 


44 


00 


80 


00 




B31 


B32 


B33 


B34 


B35 


B36 


B37 


B38 


B39 


B40 


B41 


B42 


B43 


B44 


B45 




42 


54 


00 


80 


00 


42 


64 


00 


80 


00 


42 


74 


00 


80 


00 




B46 


B47 


B48 


B49 


B50 


B51 


B52 


B53 


B54 


B55 


B56 


B57 


B58 


B59 


B60 




42 


84 


00 


80 


00 


42 


94 


00 


80 


00 


42 


04 


10 


80 


00 



4.1.1.12 



EFqplmnwact (Operator Controlled PLMN Selector with Access Technology) 



The Radio Access Technology identifier for the first PLMN is set to both UTRAN and GSM, the other remaining 
PLMNs to UTRAN only. 



Logically: 


1 st PLMN: 


254 001 (MCC MNC) 














1 st ACT: 


UTRAN 
















2 nd PLMN 


: 254 001 
















2 nd ACT: 


GSM 
















3 rd PLMN: 


254 002 
















3 rd ACT: 


UTRAN 
















4 th PLMN: 


254 003 
















4 th ACT: 


UTRAN 
















5 th PLMN: 


254 004 
















5 th ACT: 


UTRAN 
















6 th PLMN: 


254 005 
















6 th ACT: 


UTRAN 
















7 th PLMN: 


254 006 
















7 th ACT: 


UTRAN 
















8 th PLMN: 


254 007 
















8 th ACT: 


UTRAN 














Coding: B01 


B02 


B03 B04 


B05 


B06 


B07 


B08 


B09 


B10 


Hex 52 


14 


00 80 


00 


52 


14 


00 


00 


80 


B11 


B12 


B13 B14 


B15 


B16 


B17 


B18 


B19 


B20 


52 


24 


00 80 


00 


52 


34 


00 


80 


00 


B21 


B22 


B23 B24 


B25 


B26 


B27 


B28 


B29 


B30 


52 


44 


00 80 


00 


52 


54 


00 


80 


00 


B31 


B32 


B33 B34 


B35 


B36 


B37 


B38 


B39 


B40 


52 


64 


00 80 


00 


52 


74 


00 


80 


00 



4.1.1.13 



Void 



4.1.1.14 PIN 














Key reference: 01 














Logically: 2468 














Coding: B1 B2 


B3 


B4 


B5 


B6 


B7 


B8 


Hex 32 34 


36 


38 


FF 


FF 


FF 


FF 



4.1.1.15 PIN2 

Key reference: 81 
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Logically: 3579 



Coding: B1 


B2 B3 


B4 


B5 


B6 


B7 


B8 


Hex 33 


35 37 


39 


FF 


FF 


FF 


FF 


4.1.1.16 


Unblock PIN 












Key reference: 


01 












Logically: 


13243546 












Coding: B1 


B2 B3 


B4 


B5 


B6 


B7 


B8 


Hex 31 


33 32 


34 


33 


35 


34 


36 


4.1.1.17 


Unblock PIN2 












Key reference: 


81 












Logically: 


08978675 












Coding: B1 


B2 B3 


B4 


B5 


B6 


B7 


B8 


Hex 30 


38 39 


37 


38 


36 


37 


35 



4.1.1.18 Other Values of the USIM 

All other values of EFs provided by the USIM shall be set to the default values defined in the annex E of TS 31.102[4]. 
Some EFs (like the GSM Access files) may necessary for some tests and apply only to those test cases. 

4.1 .1 .19 EFpsloci (Packet Switch Location Information) 

Logically: RAI-MCC: 246 

RAI-MNC: 081 

RAI-LAC: 0001 

RAI-RAC: 05 







P-TMSI: 




"FF.. 


..FF" 














P-TMSI signature value: 


"FF.. 


.FF" 










Coding: B1 




B2 B3 


B4 


B5 


B6 B7 


B8 


B9 


B10 


B11 


Hex FF 




FF FF 


FF 


FF 


FF FF 


42 


16 


80 


00 


Coding: B12 




B13 B14 
















Hex ' 01 




05 00 
















4.1.1.20 


U 


niversal PIN 
















Key reference: 1 1 




















Logically: 




2839 
















Coding: B1 




B2 B3 


B4 


B5 


B6 B7 B8 










Hex 32 




38 33 


39 


FF 


FF FF FF 











4.1 .1 .21 Unblock Universal PIN 

Key reference: 1 1 
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Logically: 

Coding: B1 
Hex 30 



0203040506 



B2 
32 



B3 
30 



B4 
33 



B5 
30 



B6 
34 



B7 
30 



B8 
35 



4.2 



Definition of FDN UICC 



The FDN test cases require a different configuration than the one described in subclause 4. 1 . For that purpose a default 
FDN UICC is defined. In general the values of the FDN UICC are identical to the default UICC, with the following 
exceptions. 



4.2.1 Values of the EPs (FDN UICC) 



4.2.1 .1 EFust (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 

Fixed dialling numbers available 

Barred dialling numbers available 

The GSM Access available 

The Group Identifier level 1 and level 2 not available. 

Service n 33 (Packed Switched Domain) shall be set to T 

Enabled Services Table available 



Coding: 
binary 



B1 

xx1xxx11 



B2 

xxxx xxxx 



B3 

xxxx 1 xOO 



B4 

xxxx x1 XX 



B5 

XXXX XX 1 1 



The coding of EF UST shall conform with the capabilities of the USIM used. 



4.2.1 .2 EFest (Enable Service Table) 

Logically: Fixed Dialling Numbers enabled. 

Barred Dialling Numbers disabled. 
APN Control list (ACL) disabled. 



Coding: 
binary 



B1 

0000 0001 



The coding of EF E st shall conform with the capabilities of the USIM, unused Bits are set to '0'.. 



4.2.1.3 

Logically: 
Record 1: 



EFfdn (Fixed Dialling Numbers) 



Length of alpha identifier: 6 characters; 



Alpha identifier: 
Length of BCD number: 
TON and NPI: 
Dialled number: 
CCI: 
Ext2: 



Coding for record 1 : 
Hex 



B1 
46 



B2 
44 



B14 

FF 



B15 

FF 



B3 
4E 

B16 
FF 



B4 
31 

B17 
FF 



B5 
31 

B18 

FF 



"FDN111"; 

"06"; 

Telephony and International; 

+1357924680; 

None; 

None. 



B6 
31 

B19 
FF 



B7 
06 

B20 
FF 



B8 
91 



B9 
31 



B10 
75 



B11 

29 



B12 
64 



B13 
08 
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Record 2: 


Length of 


alpha identifier: 


6 characters; 














Alpha identifier: 




"FDN222"; 














Length of BCD number: 


"04"; 
















TON and NPI: 




Telephony and Unknown; 












Dialled number: 




24680; 
















CCI: 






None; 
















Ext2: 






None. 














Coding for record 2: 




















B1 


B2 B3 


B4 


B5 


B6 


B7 


B8 B9 


B10 


B11 


B12 


B13 


Hex 46 


44 4E 


32 


32 


32 


04 


81 42 


86 


F0 


FF 


FF 


B14 


B15 B16 


B17 


B18 


B19 


B20 












FF 


FF FF 


FF 


FF 


FF 


FF 












Record 3: 


Length of 


alpha identifier: 


6 characters; 














Alpha identifier: 




"FDN333"; 














Length of BCD number: 


"0B"; 
















TON and NPI: 




Telephony and International; 












Dialled number: 




+12345678901234567890; 












CCI: 






None; 
















Ext2: 






None. 














Coding for record 3: 




















B1 


B2 B3 


B4 


B5 


B6 


B7 


B8 B9 


B10 


B11 


B12 


B13 


Hex 46 


44 4E 


33 


33 


33 


0B 


91 21 


43 


65 


87 


09 


B14 


B15 B16 


B17 


B18 


B19 


B20 












21 


43 65 


87 


09 


FF 


FF 













4.2.1.4 

Logically: 



Coding: 
Hex 



B1 
21 



EFecc (Emergency Call Codes) 

Emergency call code: 

Emergency call code alpha identifier: 

Emergency call Service Category: 



B2 
F2 



B3 
FF 



B4 
54 



B5 
45 



"122"; 
"TEST"; 
Mountain Rescue. 



B6 
53 



B7 
54 



B8 
10 



4.2.1.5 



Other Values of the USIM 



All other values of EFs provided by the USIM shall be set to the default values defined in the annex E of TS 31.102. 
Some EFs (like the GSM Access files) may necessary for some tests and apply only to those test cases. 

4.3 Void 
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5 Subscription related tests 

5.1 IMSI/TMSI handling 

5.1 .1 UE identification by short IMSI 

5.1 .1 .1 Definition and applicability 

The IMSI is used for unique identification of the UE by UTRAN. The IMSI is stored in the USIM and read during the 
UICC-Terminal initialisation procedure. 

This test applies to Terminals accessing UTRAN. 

5.1 .1 .2 Conformance requirement 

After successful completion of the RRC Connection Establishment procedure the UE shall send PAGING RESPONSE 
containing the IMSI of the USIM, which is less than the maximum length. 

Reference: 

• TS 31.102, subclauses 5.1.1 and 5.2.2; 

• TS 24.008, subclause 10.5.1.4; 

• TS 102 221, subclause 14.1.1. 

5.1.1.3 Test purpose 

1) To verify that the Terminal uses the IMSI of the USIM. 

2) To verify that the Terminal can handle an IMSI of less than the maximum length. 

3) To verify that the READ EF IM si command is performed correctly by the terminal 

5.1.1.4 Method of test 

5.1 .1 .4.1 Initial conditions 

The USS transmits on the BCCH, with the following network parameters: 

Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

Access control: unrestricted. 

The default UICC is installed into the Terminal and the UE is powered on. 

5.1.1.4.2 Procedure 

a) The USS sends PAGING TYPE 1 to the UE using the IMSI stored in the USIM. 

b) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP 
to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

c) After receipt of a PAGING RESPONSE from the UE, the USS sends RRC CONNECTION RELEASE to the 
UE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS. 
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5.1.1.5 Acceptance criteria 

After step b) the UE shall send PAGING RESPONSE to the USS containing the IMSI stored in the USIM. 

5.1 .2 UE identification by short IMSI using a 2 digit MNC 



5.1.2.1 



Definition and applicability 



In some networks the IMSI identifying the UTRAN can be consistence of a 2 digit MNC. The IMSI is stored in the 
USIM and read during the UICC-Terminal initialisation procedure. 

This test applies to Terminals accessing UTRAN. 

5.1.2.2 Conformance requirement 

After successful completion of the RRC Connection Establishment procedure the UE shall send PAGING RESPONSE 
containing the IMSI of the USIM. 

Reference: 

• TS 31.102, subclause 4.2.18; 

• TS 24.008, subclause 10.5.1.4. 

5.1.2.3 Test purpose 

1) To verify that the Terminal can handle an IMSI consistence of a 2 digit MNC. 

5.1.2.4 Method of test 
5.1.2.4.1 Initial conditions 

The USS transmits on the BCCH, with the following network parameters: 

Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/81/0001. 

Access control: unrestricted. 

The default UICC is used with the following exception: 
EF L0CI (Location Information) 



Logically: 


LAI-MCC: 
LAI-MNC: 
LAI-LAC: 
TMSI: 


246 
81 

0001 
"FF .. FF" 
















Coding: B1 


B2 B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex FF 


FF FF 


FF 


42 


F6 


18 


00 


01 


FF 


00 


EF IMS i (IMSI) 




















Logically: 


246813579 


















Coding: B1 


B2 B3 


B4 


B5 


B6 


B7 


B8 


B9 






Hex 05 


29 64 


18 


53 


97 


FF 


FF 


FF 







EF AD (Administrative Data) 
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Logically: Normal operation 

OFM to be deactivated by the Terminal 
MNC: 2 digit 

Coding: B1 B2 B3 B4 

Hex 00 00 00 02 



The UICC is installed into the Terminal and the UE is powered on. 

5.1.2.4.2 Procedure 

a) The USS sends PAGING TYPE 1 to the UE using the IMSI stored in the USIM. 

b) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP 
to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

c) After receipt of a PAGING RESPONSE from the UE, the USS sends RRC CONNECTION RELEASE to the 
UE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS. 

5.1 .2.5 Acceptance criteria 

After step b) the UE shall send PAGING RESPONSE to the USS containing the IMSI stored in the USIM. 



5.1 .3 UE identification by "short" TMSI 



5.1.3.1 



Definition and applicability 



The TMSI is temporarily used for identification of the UE by UTRAN. It will have been previously assigned by the 
network. The TMSI is stored in the USIM by the Terminal and read during the USIM-Terminal initialisation procedure. 

NOTE: According to TS 23.003, subclause 2.4, a TMSI always consists of 8 digits (4 bytes). With this tests the 
handling of a TMSI with leading zeros will be tested. The term "short" TMSI is used in order to 
distinguish between the tests as defined in subclauses 5.1.3 and 5.1.4. 

This test applies to Terminals accessing UTRAN and supporting CS. 

5.1.3.2 Conformance requirement 

After successful completion of the RRC Connection Establishment procedure the UE shall send PAGING RESPONSE 
containing the TMSI stored in the USIM. According to subclause 10.3.1.17 in TS 25.331 [20] the TMSI has a fixed 
length of 32 bit (8 digits) when used inside the PAGING TYPE 1 message. 

Reference: 

• TS 31.102, subclauses 5.1.1 and 5.2.2; 

• TS 24.008, subclause 10.5.1.4. 

• TS 25.331, subclause 10.3.1.17 

5.1.3.3 Test purpose 

1) To verify that the Terminal uses the TMSI stored in the USIM. 

2) To verify that the Terminal can handle a TMSI of less than maximum length. 
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5.1.3.4 Method of test 

5.1.3.4.1 Initial conditions 

The USS transmits on the BCCH, with the following network parameters: 

Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

Access control: unrestricted. 

The default UICC is used with the following exception: 
EF LO ci (Location Information) 



Logically: 


LAI-MCC: 
LAI-MNC: 
LAI-LAC: 
TMSI: 


246 
081 
0001 
"00002143" 
















Coding: B1 


B2 B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 00 


00 21 


43 


42 


16 


80 


00 


01 


FF 


00 



The UICC is installed into the Terminal and the UE is powered on. 

5.1.3.4.2 Procedure 

a) The USS sends PAGING TYPE 1 to the UE using the TMSI stored in the USIM matching the required length of 

8 digits. 

b) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP 
to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

c) After receipt of a PAGING RESPONSE from the UE, the USS sends RRC CONNECTION RELEASE to the 
UE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS. 

5.1 .3.5 Acceptance criteria 

After step b) the UE shall send PAGING RESPONSE to the USS containing the TMSI stored in the USIM. 

5.1 .4 UE identification by "long" TMSI 

5.1 .4.1 Definition and applicability 

The TMSI is temporarily used for identification of the UE by UTRAN. It will have been previously assigned by the 
network. The TMSI is stored in the USIM by the Terminal and read during the USIM-Terminal initialisation procedure. 

NOTE: According to TS 23.003, subclause 2.4, a TMSI always consists of 8 digits (4 bytes). With this tests the 
handling of a new assigned TMSI will be tested. The term "long" TMSI is used in order to distinguish 
between the tests as defined in subclauses 5.1.3 and 5. 1.4. This test applies to Terminals accessing 
UTRAN and supporting CS. 

5.1.4.2 Conformance requirement 

After successful completion of the RRC Connection Establishment procedure the UE shall send PAGING RESPONSE 
containing the correct TMSI stored in the USIM. 

According to subclause 10.3.1.17 in TS 25.331 [20] the TMSI has a fixed length of 32 bit (8 digits) when used inside 
the PAGING TYPE 1 message. 

Reference: 
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• TS 31.102, subclauses 5.1.1 and 5.2.2; 

• TS 24.008, subclause 10.5.1.4. 

• TS 25.331, subclause 10.3.1.17 

5.1.4.3 Test purpose 

1) To verify that the Terminal uses the TMSI stored in the USIM. 

2) To verify that the Terminal can handle a TMSI of maximum length. 

3) To verify that the Terminal does not respond to page requests containing a previous TMSI. 

5.1.4.4 Method of test 
5.1.4.4.1 Initial conditions 

Prior to this test, the Terminal shall have been operated with a USIM containing TMSI "2143". This may be achieved 
by executing the previous test (5.1.3) prior to this test. Only under this condition will test purpose 3) be verified. 

The USS transmits on the BCCH, with the following network parameters: 

Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

Access control: unrestricted. 

The default UICC is used with the following exception: 
EF L0CI (Location Information) 



Logically: 


LAI-MCC: 246 
LAI-MNC: 081 
LAI-LAC: 0001 
TMSI: "21430000" 
















Coding: B1 


B2 B3 B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 21 


43 00 00 


42 


16 


80 


00 


01 


FF 


00 



The UICC is installed into the Terminal and the UE is powered on. 

5.1.4.4.2 Procedure 

a) The USS sends PAGING TYPE 1 to the UE using the TMSI "00002143". 

b) The USS sends PAGING TYPE 1 to the UE using the TMSI stored in the USIM. 

c) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP 
to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

d) After receipt of a PAGING RESPONSE from the UE, the USS sends RRC CONNECTION RELEASE to the 
UE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS. 

5.1 .4.5 Acceptance criteria 

1) After step a) the UE shall not respond to the PAGING TYPE 1. 

2) After step c) the UE shall send PAGING RESPONSE to the USS containing the TMSI stored in the USIM. 
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5.1 .5 UE identification by long IMSI, TMSI updating and key set identifier 
assignment 

5.1 .5.1 Definition and applicability 

The IMSI and TMSI are used for identification of the UE by UTRAN. They are read from the USIM during the USIM- 
Terminal initialisation procedure. Within the authentication procedure the network sends a key set identifier to the UE. 
In addition the network may allocate a new TMSI to the UE. Key set identifier and TMSI are stored in the USIM after 
call termination and/or at a 3G session termination. 

This test applies to Terminals accessing UTRAN and supporting CS. 

NOTE: According to TS 24.008 [16] the term KSI may be used instead of the term ciphering key sequence 
number which is used inside the MM message AUTHENTICATION REQUEST. 

5.1.5.2 Conformance requirement 

1) After successful completion of the RRC Connection Establishment procedure the UE shall send PAGING 
RESPONSE containing the correct IMSI stored in the USIM. 

Reference: 

• TS 31.102, subclauses 5.1.1 and 5.2.2; 

• TS 24.008, subclause 10.5.1.4. 

2) After call termination the USIM shall contain the key set identifier (ciphering key sequence number) and TMSI 
received by the UE during the authentication and TMSI reallocation procedures. 

Reference: 

• TS 31.102, subclauses 5.1.2, 5.2.5 and 5.2.6; 

• TS 21.111 subclause 10.1. 

• TS 24.008 subclause 4.3.2.4. 

3) After call termination the Terminal shall have updated EFLOCI. 
Reference: 

• TS 102 221, subclause 14.1.2. 

5.1.5.3 Test purpose 

1) To verify that the Terminal uses the IMSI stored in the USIM. 

2) To verify that the Terminal does not respond to page requests containing a previous IMSI. 

3) To verify that the Terminal can handle an IMSI of maximum length. 

4) To verify that the Terminal correctly updates the key set identifier at call termination. 

5) To verify that the Terminal correctly updates the TMSI at call termination. 

6) To verify that the UPDATE EF LO ci command is performed correctly by the terminal 



ETSI 



3GPP TS 31.121 version 4.13.0 Release 4 29 ETSI TS 131 121 V4.13.0 (2005-10) 

5.1.5.4 Method of test 

5.1.5.4.1 Initial conditions 

Prior to this test, the Terminal shall have been operated with a USIM containing IMSI "2460813579". This may be 
achieved by executing the previous test (5.1.4) prior to this test. Only under this condition will test purpose 2) be 
verified. 

The USS transmits on the BCCH, with the following network parameters: 

Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

Access control: unrestricted. 

The default UICC is used with the following exception: 

EF IMS i (IMSI) 

Logically: 246081111111111 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


Hex 


08 


29 


64 


80 


11 


11 


11 


11 


11 



The UICC is installed into the Terminal and the UE is powered on. 

5.1.5.4.2 Procedure 

a) The USS sends PAGING TYPE 1 to the UE using the IMSI "2460813579". 

b) The USS sends PAGING TYPE 1 to the UE using the IMSI stored in the USIM. 

c) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP 
to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

d) After receipt of a PAGING RESPONSE from the UE, the USS sends AUTHENTICATION REQUEST to the 
UE containing Key Set Identifier KSI (ciphering key sequence number) set to binary 010. 

e) After receipt of AUTHENTICATION RESPONSE from the UE and subsequent completion of the security 
procedure on RRC, the USS sends TMSI REALLOCATION COMMAND to the UE containing TMSI 

"32547698". 

f) Within 5 s after receipt of TMSI REALLOCATION COMPLETE from the UE, the USS sends RRC 
CONNECTION RELEASE to the UE. 

g) To allow examination of the values in the USIM after connection termination the UE shall not be soft powered 
down. If the test is performed with a USIM simulator, the simulation is stopped. If the test is performed with a 
USIM, the UICC is removed without soft powering down the UE. If this is not possible, the power supply of the 
Terminal is removed and then the UICC removed. 

5.1 .5.5 Acceptance criteria 

1) After step a) the UE shall not respond to the PAGING TYPE 1. 

2) After step c) the UE shall send PAGING RESPONSE to the USS containing the IMSI stored in the USIM. 

3) After step e) the UE shall send TMSI REALLOCATION COMPLETE to the USS. 

4) After step g) the USIM shall contain the following values: 
EF L oci (Location Information) 

Logically: LAI-MCC: 246 
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LAI-MNC: 081 
TMSI: "32547698" 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 


32 


54 


76 


98 


42 


16 


80 


XX 


XX 


XX 


00 



EF Keys (Ciphering and Integrity Keys) 



Logically: 


Key Set Identifier KSI: 
Ciphering Keys CK: 
Integrity Keys IK: 


02 

xx (result of the authentication algorithm) 

xx (result of the authentication algorithm) 






Coding: B1 
Hex 02 


B2 B3 

XX XX 


B16 B17 B18 ... B31 

XX XX XX ... XX 


B32 

XX 


B33 

XX 



5.2 Access Control handling 

5.2.1 Access Control information handling 

5.2.1 .1 Definition and applicability 

Access Control allows restriction of call access attempts. All User Equipment are assigned to one out often randomly 
allocated classes, and optionally (for priority uses) also to one or more special categories. 

An Access Class of the special Categories is only valid in the HPLMN or HPLMN country. Otherwise, the randomly 
allocated class is used. 

The classes are programmed on the USIM. The network controls which classes at any time may be barred. 

In addition, there is a separate mechanism for control of network access for emergency call attempts. 

This test applies to Terminals accessing UTRAN and supporting CS. 

5.2.1.2 Conformance requirement 

1 . The Terminal shall read the access control value as part of the USIM-Terminal initialisation procedure, and 
subsequently adopt this value. 

Reference: 

• TS 31.102, subclause 5.1.1. 

2. If the UE is a member of at least one access class which corresponds to the permitted classes as signalled over 
the air interface, and the access class is applicable in the serving network, access attempts are allowed. 
Otherwise access attempts are not allowed. 

3. If access class 10 is barred, then the UEs of classes 0-9 and the Terminals without UICCs shall not make 
emergency call attempts. 

4. UE of classes 1 1 - 15 are not allowed to make emergency call attempts if access class 10 and the relevant access 
class(es) between 11 and 15 are barred. Otherwise, emergency call attempts are allowed irrespective of the 
conditions of access class 10. 

All options are shown in figure 5-1 and are referenced to the tests. 

Reference: 

• TS 22.01 1, subclauses 4.3 and 4.4. 
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5.2.1.3 Test purpose 

1) To verify that the Terminal reads the access control value as part of the USIM-Terminal initialisation procedure, 
and subsequently adopts this value. 

2) To verify that the UE controls its network access in accordance with its access control class and the conditions 
imposed by the serving network. 

The tests verify Terminal performance for the following: 

Tests (a) and (b) No UICC in Terminal. 

Tests (c) to (e) UE with access class to 9. 

Test (f) UE with access class 11 and 15 not in HPLMN, and 

UE with access class 12,13 and 14 not in HPLMN country. 

Test (g) and (h) UE with access class 11 and 15 in HPLMN, and 

UE with access class 12,13 and 14 in HPLMN country. 

Each of the above are tested against all relevant combinations of access control and emergency call bits signalled by the 
network, as shown in table 5-1. 

5.2.1.4 Method of test 

5.2.1.4.1 Initial conditions 

The USS transmits on the BCCH, with the following network parameters: 
Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): see table 5-1. 
Access control: see table 5-1. 

- RACH: see table 5-1. 

The default UICC is installed in the Terminal containing IMSI and access control values as given in table 5-1 and the 
UE is powered on. 

NOTE: Depending on the initial value of the EF LO ci, the UE may perform a location update. This shall be 
accepted by the USS. 

5.2.1.4.2 Coding details 

USIM IMSI EF IMS i: Data Field "6F 07" 

Logically: IMSI: "2460813579" 



Coding: B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


Hex 06 


21 


64 


80 


31 


75 


F9 


FF 


FF 


Logically: 


IMSI: 




"24608135x9" 












Coding: B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


Hex 06 


21 


64 


80 


31 


x5 


F9 


FF 


FF 



Access Control class EF AC c: Data field "6F 78" 
Reference: 

• See TS 31.102 [4]. 
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NETWORK (USS) 

Access Class Barred List in SIB 3 should be set as table 5.1: 
Reference 

• TS 25.331 clause 10.3.2.1 

NOTE: The first instance of the parameter corresponds to Access Class 0, the second to Access Class 1 and so on 
up to Access Class 15. 

5.2.1.4.3 Procedure 

a) Using the MMI or EMMI a normal call set-up is attempted. 

b) Using the MMI or EMMI an emergency call set-up is attempted. 

c) The test is repeated for each set of values in table 5-1 . 

5.2.1 .5 Acceptance criteria 

After steps a) and b) the UE shall access the network, or shall make no access attempt, in accordance with table 5-1. 

NOTE: For conformance testing, to limit testing, in tests (c), (d) and (e) it is only necessary that one of the access 
classes is tested. This access class may randomly chosen. 
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Table 5-1 





USIM 






Network 






Test 
Results 




IMSI 




RACH 


Informative: Cell 


BCCH/ 


Normal 


Emergency 








SIB3: 


Barred for: 


LAI 


Call 


Call 








Access Class 
















Barred List 














Access 


AC15-AC08 


Emergency Call 


MCC 










Class 


AC07-AC00 


Normal Call 


MNC 






Test (a) 


No UICC in 


N/A 


0000 0100 


Yes 


234 


No 


No 




Terminal 




0000 0000 


No 


001 






Test (b) 


No UICC in 


N/A 


0000 0000 


No 


234 


No 


Yes 




Terminal 




0000 0000 


No 


001 






Test (c) 


"2460813579" 





0000 0100 
0000 0001 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


1 


0000 0100 
0000 0010 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


2 


0000 0100 
0000 0100 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


3 


0000 0100 
0000 1000 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


4 


0000 0100 

0001 0000 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


5 


0000 0100 
0010 0000 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


6 


0000 0100 
0100 0000 


Yes 

No, except for ACC 


246 

081 


No 


No 




"2460813579" 


7 


0000 0100 
1000 0000 


Yes 

No, except for ACC 


246 

081 


No 


No 




"2460813579" 


8 


0000 0101 
0000 0000 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


9 


0000 0110 
0000 0000 


Yes 

No, except for ACC 


246 
081 


No 


No 


Test (d) 


"2460813579" 





0000 0000 
0000 0001 


No 

None, except for ACC 


246 
081 


No 


Yes 




"2460813579" 


1 


0000 0000 
0000 0010 


No 

None, except for ACC 


246 
081 


No 


Yes 




"2460813579" 


2 


0000 0000 
0000 0100 


No 

None, except for ACC 


246 
081 


No 


Yes 




"2460813579" 


3 


0000 0000 
0000 1000 


No 

None, except for ACC 


246 
081 


No 


Yes 




"2460813579" 


4 


0000 0000 

0001 0000 


No 

None, except for ACC 


246 
081 


No 


Yes 
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"2460813579" 


5 


0000 0000 
0010 0000 


No 

None, except for ACC 


246 

081 


No 


Yes 


"2460813579" 
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ECs only, 
Test (b) applies 




All Calls, 
Test (e) 
applies 



Normal Calls allowed, 
ECs NOT allowed 
Abnormal Case, No Test 



All Calls, 
Test (h) 
applies 



'1' 

All Calls, 

Test (h) 
applies 



NOTE: UE adopts Access Class 0-9, based on IMSI, see TS 22.01 1 . 

Access Class in USIM, See TS 31 .1 02 EF ACC, "6F 78". 
ECs: Emergency Calls. 

EC BIT: Access Class 1 defined in TS 22.01 1 clause 4.4. 
AC Bit: See Access Class Barred List defined in TS 25.331 clause 10.3.2.1. 
HPLMN: Country means that the MCC of the VPLMN is the same as the MCC of the HPLMN. 



Figure 5-1 : Access control information 
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6 Security related Tests 

6.1 PIN handling 

6.1.1 Entry of PIN 

6.1 .1 .1 Definition and applicability 

The PIN is a number used to authenticate the user to the UICC for security. Entry of the correct PIN allows PIN- 
protected data to be accessed over the UICC-Terminal interface. 

This test applies to all 3G Terminals. 

6.1 .1 .2 Conformance requirement 

Following insertion of the UICC and switching on the UE, the Terminal shall check the state of the PIN. If the PIN is 
enabled, the Terminal asks the user for PIN verification. 

The VERIFY PIN function verifies the PIN presented by the Terminal to the UICC. 

Reference: 

• TS 102 221 [5], subclauses 9 and 11.1.9; 

• TS31.102[4], clause 6; 

• TS 22.030[12], subclause 6.6.1. 

6.1.1.3 Test purpose 

1) To verify that the PIN verification procedure is performed by the Terminal correctly. 

2) To verify that the basic public MMI string is supported. 

6.1.1.4 Method of test 

6.1 .1 .4.1 Initial conditions 

The Terminal is connected to a UICC or UICC simulator with the PIN enabled, and powered off. 
The default UICC is used. 

6.1.1.4.2 Procedure 

a) The Terminal is powered on. 

b) When the UE is in the "PIN check" mode, the sequence "2468#" shall be entered. 

6.1.1.5 Acceptance criteria 

1) After step b) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = "01". 

2) After step b) the UE shall give an indication "OK", following a successful execution of the command. 
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6.1.2 Change of PIN 

6.1 .2.1 Definition and applicability 

The PIN may be changed by the user, by entering the old and new PIN. The length of the PIN is between 4 and 8 digits. 
This test applies to all 3G Terminals. 

6.1.2.2 Conformance requirement 

The Terminal shall support the change of PIN procedure as defined in TS 102 221 [5] subclause 11.10. 
Reference: 

• TS 102 221[5], subclauses 9 and 11.1.10; 

• TS31.102[4], clause 6; 

• TS 22.030[12], subclause 6.6.2. 

6.1.2.3 Test purpose 

1) To verify that the PIN substitution procedure is performed correctly by the Terminal. 

2) To verify that the basic public MMI string is supported. 

6.1.2.4 Method of test 

6.1.2.4.1 Initial conditions 

The Terminal is connected to a UICC or UICC simulator with the PIN enabled. 

The default UICC is used. 

The Terminal is powered-on, with the correct PIN entered. 

6.1.2.4.2 Procedure 

a) Enter " * *04*2468 *0 1 234567*0 1 234567F . 

b) The UE is switched off and on. 

c) When the UE is in the "PIN check" mode, the sequence "2468#" shall be entered. 

d) The UE is switched off and on. 

e) When the UE is in the "PIN-check", mode the sequence "01234567#" shall be entered. 

6.1 .2.5 Acceptance criteria 

1) After step a), the Terminal shall send a CHANGE PIN command to the UICC, with the parameter P2 set to "01". 

2) Following the successful execution of the command, the UE shall give an indication that the new PIN is 
accepted. 

3) After step c), the UE shall give an indication that the entered PIN is not accepted. 
3) After step e), the UE shall give an indication "OK". 
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6.1.3 Unblock PIN 

6.1 .3.1 Definition and applicability 

After three consecutive wrong entries of the PIN, the PIN shall become blocked. The Unblock PIN command is used to 
unblock the PIN. This function may be performed whether or not the PIN is blocked. 

This test applies to 3G Terminals. 

6.1.3.2 Conformance requirement 

The Terminal shall support the Unblock PIN command, as defined in TS 102 221 [5] subclause 11.13. 
Reference: 

• TS 102 221[5], subclauses 9 and 11.1.13; 

• TS31.102[4], clause 6; 

• TS 22.030[12], subclause 6.6.3. 

6.1.3.3 Test purpose 

1) To verify that the PIN unblocking procedure is performed correctly. 

2) To verify that the basic public MMI string is supported. 

6.1.3.4 Method of test 

6.1.3.4.1 Initial conditions 

The Terminal is connected to the UICC simulator. 
The default UICC is used. 

6.1.3.4.2 Procedure 

a) The Terminal is powered on and the correct PIN is entered. 

b) Enter "**05*13243546*1234*1234#" 

c) The Terminal is powered off and on. 

d) Enter the new PIN: "1234#". 

e) The Terminal is powered off and on. 

f) Enter a wrong PIN three times. 

g) Enter "**05*13243546*2468*2468#". 
h) The Terminal is powered off and on. 
i) Enter the new PIN: "2468#". 

6.1 .3.5 Acceptance criteria 

1) After step b), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "01". 

2) After step d), the Terminal shall indicate that the PIN has been accepted. 

3) After step f), the Terminal shall indicate that the PIN has been blocked. 
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4) After step g), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "01". 

5) After step j), the Terminal shall indicate that the PIN has been accepted. 

6.1.4 Entry of PIN2 

6.1 .4.1 Definition and applicability 

The PIN2 is a number used to authenticate the user to the UICC for security. Entry of the correct PIN2 allows 
PIN2-protected data to be accessed over the UICC-Terminal interface. 

This test applies to all 3G Terminals supporting a feature requiring PIN2 entry (such as e.g. AoC or FDN). 

6.1.4.2 Conformance requirement 

Before allowing the access to PIN2 protected data, the Terminal shall ask the user for PIN2 verification. Only after 
presenting the PIN2, the user shall get access to these data. 

The VERIFY PIN function verifies the PIN2 presented by the Terminal to the UICC. 

Reference: 

• TS 102 221[5], subclauses 9 and 11.1.9; 

• TS31.102[4], clause 6; 

• TS 22.030[12], subclause 6.6.1. 

6.1.4.3 Test purpose 

1) To verify that the PIN2 verification procedure is performed by the Terminal correctly. 

2) To verify that the basic public MMI string is supported. 

6.1.4.4 Method of test 

6.1.4.4.1 Initial conditions 

The Terminal is connected to a UICC or UICC simulator with the PIN enabled, and powered off. 

The default UICC is used. 

NOTE: To perform the UPDATE FDN data (as described in the procedure below), the default FDN UICC may be 
used. 

6.1.4.4.2 Procedure 

a) The Terminal is powered on and the correct PIN is entered. 

b) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN) 

c) When the UE is in the "PIN2 check" mode, the sequence "3579#" shall be entered. 

6.1 .4.5 Acceptance criteria 

1) After step b) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = "81". 

2) After step b) the UE shall give an indication "OK", following a successful execution of the command. 
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6.1.5 Change of PIN2 

6.1 .5.1 Definition and applicability 

The PIN2 may be changed by the user, by entering the old and new PIN2. The length of the PIN2 is between 4 and 8 
digits. 

This test applies to all 3G Terminals supporting a feature requiring PIN2 entry (such as e.g. AoC or FDN) 

6.1.5.2 Conformance requirement 

The Terminal shall support the change of PIN2 procedure as defined in TS 102 221[5] subclause 11.1.10. 
Reference: 

• TS 102 221[5], subclauses 9 and 11.1.10; 

• TS31.102[4], clause 6; 

• TS 22.030[2], subclause 6.6.2. 

6.1.5.3 Test purpose 

1) To verify that the PIN2 substitution procedure is performed correctly by the Terminal. 

2) To verify that the basic public MMI string is supported. 

6.1.5.4 Method of test 

6.1.5.4.1 Initial conditions 

The Terminal is connected to a UICC or UICC simulator with the PIN2 enabled. 

The default UICC is used. 

NOTE: To perform the UPDATE FDN data (as described in the procedure below), the default FDN UICC may be 
used. 

The Terminal is powered-on, with the correct PIN entered. 

6.1.5.4.2 Procedure 

a) Enter "**042*3579*12345678*12345678#". 

b) The UE is switched off and on and the correct PIN is entered. 

c) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

d) When the UE is in the "PIN2 check" mode, the sequence "3579#" shall be entered. 

e) The UE is switched off and on and the correct PIN is entered. 

f) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

g) When the UE is in the "PIN2-check", mode the sequence "12345678#" shall be entered. 

6.1 .5.5 Acceptance criteria 

1) After step a), the Terminal shall send a CHANGE PIN2 command to the UICC, with the parameter P2 set to 
"81". 
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2) Following the successful execution of the command, the UE shall give an indication that the new PIN2 is 
accepted. 

3) After step d), the UE shall give an indication that the entered PIN2 is not accepted. 
3) After step g), the UE shall give an indication "OK". 

6.1.6 Unblock PIN2 

6.1 .6.1 Definition and applicability 

After three consecutive wrong entries of the PIN2, the PIN2 shall become blocked. The Unblock PIN2 command is 
used to unblock the PIN2. This function may be performed whether or not the PIN2 is blocked. 

This test applies to all 3G Terminals supporting a feature requiring PIN2 entry (such as e.g. AoC or FDN) 

6.1.6.2 Conformance requirement 

The Terminal shall support the Unblock PIN2 command, as defined in TS 102 221 [5] subclause 11.1.13. 
Reference: 

• TS 102 221[5],subclauses 9 and 11.1.13; 

• TS31.102[4], clause 6; 

• TS 22.030[12], subclause 6.6.3. 

6.1.6.3 Test purpose 

1) To verify that the PIN2 unblocking procedure is performed correctly. 

2) To verify that the basic public MMI string is supported. 

6.1.6.4 Method of test 

6.1.6.4.1 Initial conditions 

The Terminal is connected to the UICC simulator. 

The default UICC is used. 

NOTE: To perform the UPDATE FDN data (as described in the procedure below), the default FDN UICC may be 
used. 

6.1.6.4.2 Procedure 

a) The Terminal is powered on and the correct PIN is entered. 

b) Enter "**052*08978675*1234*1234#" 

c) The Terminal is powered off and on and the correct PIN is entered. 

d) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

e) Enter the new PIN2: "1234#". 

f) The Terminal is powered off and on and the correct PIN is entered. 

g) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 
h) Enter a wrong PIN2 three times. 



ETSI 



3GPP TS 31.121 version 4.13.0 Release 4 45 ETSI TS 131 121 V4.13.0 (2005-10) 

i) Enter "**052*08978675*3579*3579#". 

j) The Terminal is powered off and on and the correct PIN is entered. 

k) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

1) Enter the new PIN2: "3579#". 

6.1 .6.5 Acceptance criterias 

1) After step b), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "81". 

2) After step e), the Terminal shall indicate that the PIN2 has been accepted. 

3) After step h), the Terminal shall indicate that the PIN2 has been blocked. 

4) After step i), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "81". 

5) After step 1), the Terminal shall indicate that the PIN2 has been accepted. 

6.1 .7 Replacement of PIN 

6.1 .7.1 Definition and applicability 

The Universal PIN may be used to replace a PIN used to authenticate the user to the UICC for security. In this case 
entry of the correct Universal PIN allows PIN-protected data to be accessed over the UICC-Terminal interface. TS 102 
221 [5] defines the range of "01 " to "08" as key reference of the PIN on a multi-verification capable UICC. 

This test applies to all 3G Terminals. 

6.1.7.2 Conformance requirement 

The Terminal shall support the usage of the Universal PIN as replacement PIN and the replacement procedure as 
defined in TS 102 221 [5], subclause 11.1.11, as well as the procedure to disable the replacement defined in TS 102 221 
[5], subclause 11.1.12. 

Reference: 

• TS 102 221 [5], subclauses 9, 11.1.11 and 11.1.12; 

• TS 31.102 [4], clause 6; 

6.1.7.3 Test purpose 

1) To verify that the PIN replacement is supported by the Terminal correctly. 

2) To verify that the PIN replacement procedure is performed by the Terminal correctly. 

3) To verify that the procedure to disable the PIN replacement is performed by the Terminal correctly. 

6.1.7.4 Method of test 

6.1.7.4.1 Initial conditions 

The Terminal is connected to the UICC simulator with the PIN enabled, and powered off. 
The default UICC is used. 

6.1.7.4.2 Procedure 

a) The Terminal is powered on. 
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b) When the Terminal is in the "PIN check" mode, the sequence "2468#" shall be entered. 

c) The user shall initiate an MMI dependent procedure to replace the PIN by the Universal PIN. 

d) The Terminal is powered off and on and when the Terminal is in 'PIN check' mode the sequence "2468#" shall 
be entered. 

e) The correct UPIN is entered. 

f) The user shall initiate an MMI dependent procedure to disable the replacement of the PIN by the Universal PIN. 

g) The Terminal is powered off and on and when the Terminal is in 'PIN check' mode the sequence "2839#" shall 
be entered. 

h) The correct PIN is entered. 

6.1 .7.5 Acceptance criteria 

1) After step b) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = "01". 

2) After step c), the Terminal shall send a DISABLE PIN command to the UICC, with parameter Pl="91" and P2 = 
"01". 

3) After step d) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = " 11" and after 
unsuccessful execution of the command the Terminal shall indicate that the PIN has not been accepted. 

4) After step e) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = " 11" and after 
successful execution of the command the Terminal shall indicate that the PIN has been accepted. 

5) After step f), the Terminal shall send an ENABLE PIN command to the UICC, with parameter P2 = "01". 

6) After step g) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = "01" and after 
unsuccessful execution of the command the Terminal shall indicate that the PIN has not been accepted. 

7) After step e) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = "01" and after 
successful execution of the command the Terminal shall indicate that the PIN has been accepted. 

6.1 .8 Change of Universal PIN 

6.1 .8.1 Definition and applicability 

The Universal PIN may be changed by the user, by entering the old and new Universal PIN. The length of the Universal 
PIN is between 4 and 8 digits. 

This test applies to all 3G Terminals. 

6.1.8.2 Conformance requirement 

The Terminal shall support the change of PIN procedure as defined in TS 102 221 [5], subclause 11.1.10. 
Reference: 

• TS 102 221 [5], subclauses 9 and 11.1.10; 

• TS 31.102 [4], clause 6. 

6.1.8.3 Test purpose 

To verify that the PIN substitution procedure is performed correctly by the Terminal. 
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6.1.8.4 Method of test 

6.1.8.4.1 Initial conditions 

The Terminal is connected to a UICC or UICC simulator with the PIN enabled. 
The default UICC is used with the following exception: 

The Universal PIN is used as a replacement of the PIN. 
The Terminal is powered-on, with the correct Universal PIN entered. 

6.1.8.4.2 Procedure 

a) The user shall initiate an MMI dependent procedure to change the Universal PIN to "01234567". 

b) The UE is switched off and on. 

c) When the UE is in the "PIN check" mode, the sequence "2839#" shall be entered. 

d) The UE is switched off and on. 

e) When the UE is in the "PIN-check", mode the sequence "01234567#" shall be entered. 

6.1 .8.5 Acceptance criteria 

1) After step a), the Terminal shall send a CHANGE PIN command to the UICC, with the parameter P2 set to " 11". 

2) Following the successful execution of the command, the UE shall give an indication that the new (Universal) 
PIN is accepted. 

3) After step c), the UE shall give an indication that the entered (Universal) PIN is not accepted. 

4) After step e), the UE shall give an indication "OK". 

6.1 .9 Unblock Universal PIN 

6.1 .9.1 Definition and applicability 

After three consecutive wrong entries of the PIN, the PIN shall become blocked. The Unblock PIN command is used to 
unblock the PIN. This function may be performed whether or not the PIN is blocked. 

This test applies to all 3G Terminals. 

6.1.9.2 Conformance requirement 

The Terminal shall support the Unblock PIN command, as defined in TS 102 221 [5], subclause 11.13. 
Reference: 

• TS 102 221 [5], subclause 11.1.13; 

• TS 31.102 [4], clause 6. 

6.1.9.3 Test purpose 

To verify that the PIN unblocking procedure is performed correctly. 
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6.1.9.4 Method of test 

6.1.9.4.1 Initial conditions 

The Terminal is connected to the UICC simulator. 
The default UICC is used. 

6.1.9.4.2 Procedure 

a) The Terminal is powered on and the correct PIN is entered. 

b) The user shall initiate an MMI dependent procedure to unblock the Universal PIN and set the new Universal PIN 

value to "1234". 

c) The Terminal is powered off and on. 

d) Enter the new PIN: "1234#". 

e) The Terminal is powered off and on. 

f) Enter a wrong PIN three times. 

g) The user shall initiate an MMI dependent procedure to unblock the Universal PIN and set the new Universal PIN 
value to "2839". 

h) The Terminal is powered off and on. 

i) Enter the new PIN: "2839#". 

6.1 .9.5 Acceptance criteria 

1) After step b), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = " 11 ". 

2) After step d), the Terminal shall indicate that the (Universal) PIN has been accepted. 

3) After step f), the Terminal shall indicate that the (Universal) PIN has been blocked. 

4) After step g), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = " 11". 

5) After step j), the Terminal shall indicate that the (Universal) PIN has been accepted. 

6.1 .10 Entry of PIN on multi-verification capable UlCCs 

6.1 .1 0.1 Definition and applicability 

The PIN is a number used to authenticate the user to the UICC for security. Entry of the correct PIN allows PIN- 
protected data to be accessed over the UICC-Terminal interface. TS 102 221 [5] defines the range of "01" to "08" as key 
reference of the PIN on a multi-verification capable UICC. 

This test applies to all 3G Terminals. 

6.1.10.2 Conformance requirement 

Following insertion of the UICC and switching on the UE, the Terminal shall check the state of the PIN. If the PIN is 
enabled, the Terminal asks the user for PIN verification. 

The VERIFY PIN function verifies the PIN presented by the Terminal to the UICC. 

Reference: 

• TS 102 221 [5], subclauses 9 and 11.1.9; 
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• TS 31.102 [4], clause 6; 

• TS 22.030 [12], subclause 6.6.1. 

6.1.10.3 Test purpose 

1) To verify that the PIN verification procedure is performed by the Terminal correctly. 

2) To verify that the basic public MMI string is supported. 

3) To verify that the Terminal supports key references in the range of "01" to "08" as PIN. 
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6.1.10.4 



Method of test 



6.1 .1 0.4.1 Initial conditions 

The Terminal is connected to the UICC simulator with the PIN enabled, and powered off. 

The default UICC is used with the following exceptions: 

The UICC shall be configured to use "07" as the key reference of the PIN and "87" as key reference of the PIN2 with 
the following values: 
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6.1.10.4.2 Procedure 

a) The Terminal is powered on. 
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b) When the UE is in the "PIN check" mode, the sequence "8642#" shall be entered. 

6.1 .1 0.5 Acceptance criteria 

1) After step b) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = "07". 

2) After step b) the UE shall give an indication "OK", following a successful execution of the command. 

6.1 .1 1 Change of PIN on multi-verification capable UlCCs 

6.1 .1 1 .1 Definition and applicability 

The PIN may be changed by the user, by entering the old and new PIN. The length of the PIN is between 4 and 8 digits. 
TS 102 221 [5] defines the range of "01 " to "08" as key reference of the PIN on a multi-verification capable UICC. 

This test applies to all 3G Terminals. 

6.1 .1 1 .2 Conformance requirement 

The Terminal shall support the change of PIN procedure as defined in TS 102 221 [5], subclause 11.1.10. 
Reference: 

• TS 102 221 [5], subclauses 9 and 11.1.10; 

• TS 31.102 [4], clause 6; 

• TS 22.030 [12], subclause 6.6.2. 

6.1.11.3 Test purpose 

1) To verify that the PIN substitution procedure is performed correctly by the Terminal. 

2) To verify that the basic public MMI string is supported. 

3) To verify that the Terminal supports key references in the range of "01" to "08" as PIN. 

6.1.11.4 Method of test 
6.1.11.4.1 Initial conditions 

The Terminal is connected to the UICC simulator with the PIN enabled. 

The default UICC is used with the following exceptions: 

The UICC shall be configured to use "07" as the reference of the PIN and "87" as reference of the PIN2 with the 
following values: 
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The Terminal is powered-on, with the correct PIN entered. 

6.1.11.4.2 Procedure 

a) Enter "**04*8642*01234567*01234567#". 

b) The UE is switched off and on. 

c) When the UE is in the "PIN check" mode, the sequence "8642#" shall be entered. 

d) The UE is switched off and on. 

e) When the UE is in the "PIN-check", mode the sequence "01234567#" shall be entered. 

6.1.11.5 Acceptance criteria 

1) After step a), the Terminal shall send a CHANGE PIN command to the UICC, with the parameter P2 set to "07". 

2) Following the successful execution of the command, the UE shall give an indication that the new PIN is 
accepted. 

3) After step c), the UE shall give an indication that the entered PIN is not accepted. 

4) After step e), the UE shall give an indication "OK". 

6.1 .12 Unblock PIN on multi-verification capable UlCCs 



6.1.12.1 



Definition and applicability 



After three consecutive wrong entries of the PIN, the PIN shall become blocked. The Unblock PIN command is used to 
unblock the PIN. This function may be performed whether or not the PIN is blocked. TS 102 221 [5] defines the range 
of "01" to "08" as key reference of the PIN on a multi-verification capable UICC. 

This test applies to all 3G Terminals. 

6.1.12.2 Conformance requirement 

The Terminal shall support the Unblock PIN command, as defined in TS 1 02 22 1 [5 ] , subclause 11.1.13. 
Reference: 
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• TS 102 221 [5], subclauses 9 and 11.1.13; 

• TS 31.102 [4], clause 6; 

• TS 22.030 [12], subclause 6.6.3. 

6.1.12.3 Test purpose 

1) To verify that the PIN unblocking procedure is performed correctly. 

2) To verify that the basic public MMI string is supported. 

3) To verify that the Terminal supports key references in the range of "01" to "08" as PIN. 

6.1.12.4 Method of test 
6.1 .1 2.4.1 Initial conditions 

The Terminal is connected to the UICC simulator. 

The default UICC is used with the following exceptions: 

The UICC shall be configured to use "07" as the reference of the PIN and "87" as reference of the PIN2 with the 
following values: 
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6.1.12.4.2 Procedure 

a) The Terminal is powered on and the correct PIN is entered. 

b) Enter "**05*64534231*1234*1234#" 

c) The Terminal is powered off and on. 

d) Enter the new PIN: "1234#". 

e) The Terminal is powered off and on. 

f) Enter a wrong PIN three times. 

g) Enter "**05*64534231*8642*8642#". 
h) The Terminal is powered off and on. 

i) Enter the new PIN: "8642#". 

6.1.12.5 Acceptance criteria 

1) After step b), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "07". 

2) After step d), the Terminal shall indicate that the PIN has been accepted. 

3) After step f), the Terminal shall indicate that the PIN has been blocked. 

4) After step g), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "07". 

5) After step j), the Terminal shall indicate that the PIN has been accepted. 

6.1 .13 Entry of PIN2 on multi-verification capable UlCCs 

6.1 .1 3.1 Definition and applicability 

The PIN2 is a number used to authenticate the user to the UICC for security. Entry of the correct PIN2 allows 
PIN2-protected data to be accessed over the UICC-Terminal interface. TS 102 221 [5] defines the range of "81" to "88" 
as key reference of the PIN2 on a multi-verification capable UICC. 

This test applies to all 3G Terminals supporting a feature requiring PIN2 entry (such as e.g. AoC or FDN). 

6.1.13.2 Conformance requirement 

Before allowing the access to PIN2 protected data, the Terminal shall ask the user for PIN2 verification. Only after 
presenting the PIN2, the user shall get access to these data. 

The VERIFY PIN function verifies the PIN2 presented by the Terminal to the UICC. 

Reference: 

• TS 102 221 [5], subclauses 9 and 11.1.9; 

• TS 31.102 [4], clause 6; 

• TS 22.030 [12], subclause 6.6.1. 

6.1.13.3 Test purpose 

1) To verify that the PIN2 verification procedure is performed by the Terminal correctly. 

2) To verify that the basic public MMI string is supported. 

3) To verify that the Terminal supports key references in the range of "81" to "88" as PIN2. 
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6.1.13.4 



Method of test 



6.1 .1 3.4.1 Initial conditions 

The Terminal is connected to the UICC simulator with the PIN enabled, and powered off. 

The default UICC is used with the following exceptions: 

The UICC shall be configured to use "07" as the reference of the PIN and "87" as reference of the PIN2 with the 
following values: 
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NOTE: To perform the UPDATE FDN data (as described in the procedure below), the default FDN UICC may be 
used. In this case the above mentioned exceptions shall apply. 

6.1.13.4.2 Procedure 

a) The Terminal is powered on and the correct PIN is entered. 

b) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN) 

c) When the UE is in the "PIN2 check" mode, the sequence "9753#" shall be entered. 

6.1 .1 3.5 Acceptance criteria 

1) After step b) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = "87". 
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2) After step b) the UE shall give an indication "OK", following a successful execution of the command. 

6.1 .14 Change of PIN2 on multi-verification capable UlCCs 

6.1 .1 4.1 Definition and applicability 

The PIN2 may be changed by the user, by entering the old and new PIN2. The length of the PIN2 is between 4 and 8 
digits. TS 102 221[5] defines the range of "81" to "88" as key reference of the PIN2 on a multi-verification capable 
UICC. 

This test applies to all 3G Terminals supporting a feature requiring PIN2 entry (such as e.g. AoC or FDN) 

6.1.14.2 Conformance requirement 

The Terminal shall support the change of PIN2 procedure as defined in TS 102 221 [5], subclause 11.1.10. 
Reference: 

• TS 102 221 [5], subclauses 9 and 11.1.10; 

• TS 31.102 [4], clause 6; 

• TS 22.030 [12], subclause 6.6.2. 

6.1.14.3 Test purpose 

1) To verify that the PIN2 substitution procedure is performed correctly by the Terminal. 

2) To verify that the basic public MMI string is supported. 

3) To verify that the Terminal supports key references in the range of "81" to "88" as PIN2. 

6.1.14.4 Method of test 
6.1.14.4.1 Initial conditions 

The Terminal is connected to the UICC simulator with the PIN2 enabled. 

The default UICC is used with the following exceptions: 

The UICC shall be configured to use "07" as the reference of the PIN and "87" as reference of the PIN2 with the 
following values: 
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NOTE: To perform the UPDATE FDN data (as described in the procedure below), the default FDN UICC may be 
used. In this case the above mentioned exceptions shall apply. 

The Terminal is powered-on, with the correct PIN entered. 

6.1.14.4.2 Procedure 

a) Enter "**042*9753*12345678*12345678#". 

b) The UE is switched off and on and the correct PIN is entered. 

c) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

d) When the UE is in the "PIN2 check" mode, the sequence "9753#" shall be entered. 

e) The UE is switched off and on and the correct PIN is entered. 

f) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

g) When the UE is in the "PIN2-check", mode the sequence "12345678#" shall be entered. 

6.1.14.5 Acceptance criteria 

1) After step a), the Terminal shall send a CHANGE PIN2 command to the UICC, with the parameter P2 set to 
"87". 

2) Following the successful execution of the command, the UE shall give an indication that the new PIN2 is 
accepted. 

3) After step d), the UE shall give an indication that the entered PIN2 is not accepted. 
3) After step g), the UE shall give an indication "OK". 

6.1 .15 Unblock PIN2 on multi-verification capable UlCCs 
6.1 .1 5.1 Definition and applicability 

After three consecutive wrong entries of the PIN2, the PIN2 shall become blocked. The Unblock PIN2 command is 
used to unblock the PIN2. This function may be performed whether or not the PIN2 is blocked. TS 102 221 [5] defines 
the range of "81" to "88" as key reference of the PIN2 on a multi-verification capable UICC. 

This test applies to all 3G Terminals supporting a feature requiring PIN2 entry (such as e.g. AoC or FDN) 
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6.1.15.2 Conformance requirement 

The Terminal shall support the Unblock PIN2 command, as defined in TS 102 221 [5], subclause 11.1.13. 
Reference: 

• TS 102 221 [5],subclauses 9 and 11.1.13; 

• TS 31.102 [4], clause 6; 

• TS 22.030 [12], subclause 6.6.3. 

6.1.15.3 Test purpose 

1) To verify that the PIN2 unblocking procedure is performed correctly. 

2) To verify that the basic public MMI string is supported. 

3) To verify that the Terminal supports key references in the range of "81" to "88" as PIN2. 



6.1.15.4 



Method of test 



6.1 .1 5.4.1 Initial conditions 

The Terminal is connected to the UICC simulator. 

The default UICC is used with the following exceptions: 

The UICC shall be configured to use "07" as the reference of the PIN and "87" as reference of the PIN2 with the 
following values: 
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Coding: B1 B2 B3 B4 B5 B6 B7 B8 

Hex 35 37 36 38 37 39 38 30 

NOTE: To perform the UPDATE FDN data (as described in the procedure below), the default FDN UICC may be 
used. In this case the above mentioned exceptions shall apply. 

6.1.15.4.2 Procedure 

a) The Terminal is powered on and the correct PIN is entered. 

b) Enter "**052*57687980*1234*1234#" 

c) The Terminal is powered off and on and the correct PIN is entered. 

d) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

e) Enter the new PIN2: "1234#". 

f) The Terminal is powered off and on and the correct PIN is entered. 

g) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 
h) Enter a wrong PIN2 three times. 

i) Enter "**052*57687980*9753*9753#". 

j) The Terminal is powered off and on and the correct PIN is entered. 

k) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

1) Enter the new PIN2: "9753#". 

6.1.15.5 Acceptance criterias 

1) After step b), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "87". 

2) After step e), the Terminal shall indicate that the PIN2 has been accepted. 

3) After step h), the Terminal shall indicate that the PIN2 has been blocked. 

4) After step i), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "87". 

5) After step 1), the Terminal shall indicate that the PIN2 has been accepted. 

6.1 .1 6 Replacement of PIN with key reference "07" 

6.1 .1 6.1 Definition and applicability 

The Universal PIN may be used to replace a PIN used to authenticate the user to the UICC for security. In this case 
entry of the correct Universal PIN allows PIN -protected data to be accessed over the UICC-Terminal interface. 

This test applies to all 3G Terminals. 

6.1.16.2 Conformance requirement 

The Terminal shall support the usage of the Universal PIN as replacement PIN and the replacement procedure as 
defined in TS 102 221 [5], subclause 11.1.11, as well as the procedure to disable the replacement defined in TS 102 221 
[5], subclause 11.1.12. 

Reference: 

• TS 102 221 [5], subclauses 9, 11.1.11 and 11.1.12; 
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• TS 31.102 [4], clause 6; 

6.1.16.3 Test purpose 

1) To verify that the PIN replacement is supported by the Terminal correctly. 

2) To verify that the PIN replacement procedure is performed by the Terminal correctly. 

3) To verify that the procedure to disable the PIN replacement is performed by the Terminal correctly. 

4) To verify that the Terminal supports key references in the range of "01" to "08" as PIN. 



6.1.16.4 



Method of test 



6.1 .1 6.4.1 Initial conditions 

The Terminal is connected to the UICC simulator with the PIN enabled, and powered off. 

The default UICC is used with the following exceptions: 

The UICC shall be configured to use "07" as the reference of the PIN and "87" as reference of the PIN2 with the 
following values: 
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6.1.16.4.2 Procedure 

a) The Terminal is powered on. 
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b) When the Terminal is in the "PIN check" mode, the sequence "8642#" shall be entered. 

c) The user shall initiate an MMI dependent procedure to replace the PIN by the Universal PIN. 

d) The Terminal is powered off and on and when the Terminal is in 'PIN check' mode the sequence "8642#" shall 
be entered. 

e) The correct Universal PIN is entered. 

f) The user shall initiate an MMI dependent procedure to disable the replacement of the PIN by the Universal PIN. 

g) The Terminal is powered off and on and when the Terminal is in 'PIN check' mode the sequence "2839#" shall 
be entered. 

h) The correct PIN is entered. 

6.1.16.5 Acceptance criteria 

1) After step b) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = "07". 

2) After step c), the Terminal shall send a DISABLE PIN command to the UICC, with parameter Pl="91" and P2 = 
"07". 

3) After step d) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = " 11" and after 
unsuccessful execution of the command the Terminal shall indicate that the PIN has not been accepted. 

4) After step e) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = " 11" and after 
successful execution of the command the Terminal shall indicate that the PIN has been accepted. 

5) After step f), the Terminal shall send an ENABLE PIN command to the UICC, with parameter P2 = "07". 

6) After step g) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = "07" and after 
unsuccessful execution of the command the Terminal shall indicate that the PIN has not been accepted. 

7) After step e) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = "07" and after 
successful execution of the command the Terminal shall indicate that the PIN has been accepted. 



6.2 Fixed Dialling Numbers (FDN) handling 

6.2.1 Terminal and USIM with FDN enabled, EF AD n readable and 
updateable 

6.2.1 .1 Definition and applicability 

Fixed Dialling Numbers (FDN) is a service defined for the USIM. An enabled FDN service results in call restrictions 
for the UE. The call restrictions are controlled by the Terminal. To ascertain the type of USIM and state of FDN the UE 
runs the FDN capability request procedure during UICC-Terminal initialisation. During the initialisation the Terminal 
shall request the Emergency call codes of the USIM EF ECC . At the time an emergency call is setup using the emergency 
call code read from the EF EC c, the UE shall use the category of the emergency service indicated. 

This test applies to Terminals accessing UTRAN. Besides of that, this test is applicable only to those Terminals 
supporting FDN and CS. 

6.2.1.2 Conformance requirement 

1) Recognising the state of the USIM (FDN enabled) the UE shall perform the UICC initialisation procedure as 
specified. 

2) The UE allows call set-up to a directory number as stored in EF FDN . 
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3) The UE allows call set-up to a directory number as stored in EF FDN and extended by digits in the end. 

4) The UE does not allow call set-up to a directory number stored in EF FDN but with missing digits at the end. 

5) The UE does not allow call set-up to a directory number having no reference in EF FDN . 

6) The UE does not allow call set-up of an emergency call using the emergency number stored in the Terminal 
except "112", "911" and the emergency numbers stored on the SIM/USIM. 

7) The UE allows call set-up of an emergency call using the emergency number stored in the USIM. 

8) The UE shall indicate the emergency service category as "Mountain Rescue", when using the emergency number 
stored in the USIM. 

Reference: 

• TS22.101[11], clauses 9 and A.25; 

• TS 31.102[4], subclauses 4.4.2, 4.2.24, 5.1.1 and 5.3.2; 

• TS 24.008[16], subclause 10.5.4.33. 

6.2.1.3 Test purpose 

1) To verify that the Terminal allows call set-up to a FDN number. 

2) To verify that the Terminal allows call set-up to a FDN number extended by some digits in the end. 

3) To verify that the Terminal rejects call set-up to number having no reference in EF FDN . 

4) To verify that the Terminal rejects call set-up to a FDN number not completely corresponding to an entry in 

EF FDN . 

5) To verify that the Terminal does not allow emergency call set-up using the emergency number stored in the 
Terminal except "112", "911" and the emergency numbers stored on the SIM/USIM. 

6) To verify that the Terminal allows emergency call set-up using the emergency number stored in the UISM. 

7) To verify that the Terminal reads correctly the emergency service category. 

6.2.1.4 Method of test 

6.2.1.4.1 Initial conditions 

The USS transmits on the BCCH, with the following network parameters 

Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

Access control: unrestricted. 

The default FDN UICC with FDN service enabled and EF ADN readable and updateable is installed into the Terminal. 

6.2.1.4.2 Procedure 

a) The UE is powered on and PIN is entered. 

b) Using the MMI a call set-up to the fixed dialling number 1 (record 1) is attempted. 

c) Using the MMI a call set-up to the fixed dialling number 2 (record 2) extended by "123" in the end is attempted. 

d) Using the MMI a call set-up to a number which is equal to the fixed dialling number 3 (record 3) without the last 
digit is attempted, e.g. by recalling the fixed dialling number 3 and deleting the last digit (only in display). 
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e) Using the MMI a call set-up to the number "1234567" is attempted. 

f) Using the MMI an emergency call set-up is attempted using the emergency call code stored in the Terminal, but 
not "112", "911" nor one of the emergency numbers stored on the SIM/USIM.. 

g) Using the MMI an emergency call set-up is attempted using either "112" or "911". 

h) Using the MMI an emergency call set-up is attempted using the emergency call code stored in the USIM 

(i.e. "122"). 

NOTE: For step f) one of the emergency call codes according to TS 22.101 [11], subclause 9.1, except "112" and 
"911", shall be used (i.e. "000", "08", "110", "118", "199", or "999"). 

6.2.1 .5 Acceptance criteria 

1) After step a) the UE is registered and in idle state. 

2) After steps b) and c) the UE shall allow call set-up and send the requested number across the air interface. 

3) After steps d), e) and f) the UE shall prevent call set-up. 

4) After steps g) and h) the UE shall allow emergency call by indicating the call setup as "Emergency Call". 

5) After step g) the UE shall send the emergency service category correctly as "Mountain Rescue". 

6.2.2 Terminal and USIM with FDN disabled 

6.2.2.1 Definition and applicability 

Fixed Dialling Numbers (FDN) is a service defined for the USIM. An enabled FDN service results in call restrictions 
for the UE. Only directory numbers which are stored in the EF FDN may be dialled by the UE. The call restrictions are 
controlled by the Terminal. To ascertain the type of USIM and state of FDN the UE runs the FDN capability request 
procedure during UICC-Terminal initialisation. Deactivation of the service by the subscriber is possible under the 
control of PIN2 and switches the USIM into a "normal", non restrictive USIM. 

This test applies to Terminals accessing UTRAN. Besides of that, this test is applicable only to those Terminals 
supporting FDN and CS. 

6.2.2.2 Conformance requirement 

1) Recognising the state of the USIM (FDN disabled) the UE correctly performs the UICC initialisation procedure. 

2) The UE allows call set-up to a directory number as stored in EF FDN . 

3) The UE allows call set-up to a directory number as stored in EF ADN . 

4) The UE allows call set-up to a directory number given in manually. 
Reference: 

• TS22.101[11], clauses 9 and A.25; 

• TS31.102[4], subclauses 4.4.2.3, 4.2.24, 4.2.47, 5.1.1 and 5.3.2. 

6.2.2.3 Test purpose 

1) To verify that the Terminal as a result of the state of the USIM correctly performs the UICC-Terminal 
initialisation procedure. 

2) To verify that the Terminal allows call set-up to a FDN number. 

3) To verify that the Terminal allows call set-up to a ADN number. 

4) To verify that the Terminal allows call set-up to manually given number. 
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6.2.2.4 Method of test 

6.2.2.4.1 Initial conditions 

The USS transmits on the BCCH, with the following network parameters: 

Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

Access control: unrestricted. 

The default FDN UICC is used with the following exception: 

EF EST (Enable Service Table) 

Logically: Fixed Dialling Numbers disabled. 

Barred Dialling Numbers disabled. 
APN Control list (ACL) disabled. 

Coding: B1 
Binary 0000 0000 

The UICC is installed into the Terminal and the UE is powered on. 

6.2.2.4.2 Procedure 

a) Using the MMI a call set-up to the fixed dialling number 1 is attempted. 

b) Using the MMI a call set-up to the abbreviated dialling number 1 is attempted. 

c) Using the MMI a call set-up to the number "1234567" is attempted. 

6.2.2.5 Acceptance criteria 

After steps a), b) and c) the UE shall allow call set-up and send the requested number across the air interface. 

6.2.3 Enabling, disabling and updating of FDN 

6.2.3.1 Definition and applicability 

FDN may be enabled and disabled by the subscriber under control of PIN2. Fixed dialling numbers are read with PIN 
and updated under control of PIN2. 

This test applies to Terminals accessing UTRAN. Besides of that, this test is applicable only to those Terminals 
supporting FDN and CS. 

6.2.3.2 Conformance requirement 

1) Recognising the state of the USIM (FDN enabled) the UE shall perform the UICC initialisation procedure as 
specified. 

2) The UE shall allow updating of EF FDN by the use of PIN2. 

3) The UE provides means to disable the FDN service by the use of PIN2. 

4) The UE shall allow the use of EF ADN after disabling of FDN. 
Reference: 

• TS22.101[11], clause 9 and A.25; 
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• TS31.102[4], subclauses 4.4.2.3, 4.2.24, 4.2.47, 5.1.1 and 5.3.2. 

6.2.3.3 Test purpose 

1) To verify that the Terminal correctly performs the update of a number in EF FDN . 

2) To verify that the Terminal correctly disables FDN service. 

3) To verify that the Terminal recognises disabling of FDN and allows access to EF ADN . 

6.2.3.4 Method of test 

6.2.3.4.1 Initial conditions 

The USS transmits on the BCCH, with the following network parameters 

Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

Access control: unrestricted. 

The default FDN UICC with FDN service enabled is installed into the Terminal. 

6.2.3.4.2 Procedure 

a) The UE is powered on and PIN is entered. 

b) Using the MMI the directory number "+876543210" is stored in EF FDN as fixed dialling number 1 (record 1). 
The alpha identifier is not changed. On request of the UE PIN2 is entered. 

c) Using the MMI the FDN disabling procedure is performed. On request of the UE PIN2 is entered. 

d) Using the MMI a call set-up to the abbreviated dialling number 1 (record 1) is attempted. 

e) The UE is soft-powered down. 

6.2.3.5 Acceptance criteria 

1) After step a) the UE is registered and in idle state. 

2) After step c) the UE shall indicate that the FDN disabling procedure has been successful. 

3) After step d) the UE shall allow call set-up and send the requested number across the air interface. 

4) After step e) record 1 in EF FDN , shall contain the following values: 

Hex 



B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


B13 


46 


44 


4E 


31 


31 


31 


06 


91 


78 


56 


34 


12 


F0 


B14 


B15 


B16 


B17 


B18 


B19 


B20 














FF 


FF 


FF 


FF 


FF 


FF 


FF 
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6.3 Void 

6.4 Advice of charge (AoC) handling 

6.4.1 AoC not supported by USIM 

6.4.1 .1 Definition and applicability 

If the Terminal under test supports Advice of Charge Charging, it shall still look at the capability of the USIM, before 
responding to any AoCC information from the network. 

This test applies to Terminals accessing UTRAN. Besides of that, this test is applicable only to those Terminals 
supporting AoCC and CS. 

6.4.1.2 Conformance requirement 

1) An UE not supporting AoCC and in the outgoing call / U4 call delivered state, on receipt of a CONNECT 
message containing AoCC information shall acknowledge the CONNECT message but ignore and not 
acknowledge the AoCC information sent within the CONNECT. 

2) An UE not supporting AoCC and in the outgoing call / U4 call delivered state, on receipt of a FACILITY 
message containing AoCC information shall ignore and not acknowledge the AoCC information sent within the 
FACILITY. 

3) An UE not supporting AoCC and in the incoming call / U9 call confirmed state, on receipt of a FACILITY 
message containing AoCC information shall ignore and not acknowledge the AoCC information sent within the 
FACILITY. 

4) An UE not supporting AoCC and in the U10 call active state, on receipt of a FACILITY message containing 
AoCC information, shall ignore and not acknowledge the AoCC information sent within the FACILITY. 

References: 

• TS 24.008[16], subclause 5.1.2.1; 

• TS 23.086[9], subclauses 1.2, 1.3, 2.2 and 2.3; 

• TS 24.086[10], clause 2. 

6.4.1.3 Test purpose 

1) To verify that an UE not supporting AoCC (where the Terminal does support AoCC but the USIM does not) and 
in the outgoing call / U4 call delivered state, on receipt of a CONNECT message containing AoCC information 
shall acknowledge the CONNECT message but ignore and not acknowledge the AoCC information sent within 
the CONNECT. 

2) To verify that an UE not supporting AoCC (where the Terminal does support AoCC but the USIM does not) and 
in the outgoing call / U4 call delivered state, on receipt of a FACILITY message containing AoCC information 
shall ignore and not acknowledge the AoCC information sent within the FACILITY. 

3) To verify that an UE not supporting AoCC (where the Terminal does support AoCC but the USIM does not) and 
in the incoming call / U9 call confirmed state, on receipt of a FACILITY message containing AoCC information 
shall ignore and not acknowledge the AoCC information sent within the FACILITY. 

4) To verify that an UE not supporting AoCC (where the Terminal does support AoCC but the USIM does not) and 
in the U10 call active state, on receipt of a FACILITY message containing AoCC information, shall ignore and 
not acknowledge the AoCC information sent within the FACILITY. 
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6.4.1.4 Method of test 

6.4.1.4.1 Initial conditions 

The Terminal shall be installed with a UICC or USIM simulator, with all elementary files coded as for the default 
UICC, with the exception of: 

EF UST (USIM Service Table) 

Logically: Local Phone Book available; 

User controlled PLMN selector available; 

Fixed dialling numbers available; 

The GSM Access available; 

The Group Identifier level 1 and level 2 not available; 

AoC not available. 

Service n 33 (Packed Switched Domain) shall be set to T 

Enabled Services Table available 



Coding: 


B1 


B2 


B3 


B4 


B5 


binary 


XXXX XX 1 1 


xxxO XXXX 


xxxx 1 xOO 


xxxx x1 XX 


XXXX XX 1 1 



The coding of EF US t shall conform with the capabilities of the USIM used. 

The generic call set up procedures defined in TS 34.108 [21], subclause 7.2.3.2.3 and 7.2.3.1.3 are followed up to and 
including the reception, or transmission of the ALERTING message by the UE. 

6.4.1.4.2 Procedure 

a) For an MO call in the U4 state the USS transmits CONNECT containing AoCC information. 

b) For an MO call in the U4 state the USS transmits FACILITY containing AoCC information. 

c) For an MT call in the U9 state the USS transmits FACILITY containing AoCC information. 

d) For an MO call in the U10 state the USS transmits FACILITY containing AoCC information. 

6.4.1 .5 Acceptance criteria 

In all cases, the UE shall ignore the AoCC information sent to it in the Facility information elements as part of the 
CONNECT/FACILITY messages and not send any AoCC information acknowledgement. It shall be checked for 15 s 
that the UE does not transmit any AoCC information acknowledgement after the receipt of AoCC information. 

6.4.2 Maximum frequency of ACM updating 

6.4.2.1 Definition and applicability 

During a call, the ACM shall be updated at the end of every interval. The interval length is the greater of either 5 s or 
the value given by parameter e2 (part of the Facility Information Element). 

This test applies to Terminals accessing UTRAN. Besides of that, this test is applicable only to those Terminals 
supporting AoCC and CS. 

6.4.2.2 Conformance requirement 

The ACM shall be incremented when the CCM is incremented or once every 5 s, whichever is the longer period. 

When used the value '1C shall be used as SFI for EF ACM , for compatibility reasons the terminal shall accept other 
values. 

Reference: 
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• TS 22.024[8], subclause 4.3, part h; 

• TS 31.102 [4], subclauses 4.2.9, 5.3.4 and Annex H.l. 

6.4.2.3 Test purpose 

1) To verify that the Terminal, during a call, increments the ACM every 5 s when e2 is less or equal to 5 s. 

2) To verify that the Terminal is able to handle other values than '1C as SFI of EF ACM - 

6.4.2.4 Method of test 

6.4.2.4.1 Initial conditions 

The Terminal shall be connected to the USIM simulator, with all elementary files coded as default with the exception 
of: 

EF UST (USIM Service Table) 

Logically: Local Phone Book available; 

User controlled PLMN selector available; 

Fixed dialling numbers available; 

The GSM Access available; 

The Group Identifier level 1 and level 2 not available; 

AoC available. 

Service n 33 (Packed Switched Domain) shall be set to T 

Enabled Services Table available 

Coding: B1 B2 B3 B4 B5 

binary xxxxxx11 xxxl xxxx xxxx1x00 xxxxxlxx xxxxxx11 

The coding of EF UST shall conform with the capabilities of the USIM used. 
EF A cm (Accumulated call meter) 

Logically: 50 units 

EF AC Mmax (Accumulated call meter maximum) 

Logically: 150 units 

The USS transmits on the BCCH, with the following network parameters: 
Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 
Access control: unrestricted. 

User Equipment: 

The UE is in MM-state "idle, updated". 

6.4.2.4.2 Procedure 

a) The UE is made to initiate a call. The call establishment shall be performed according to the procedures defined 
in TS 34.108 [21], subclause 7.2.3.2.3 extended by the messages of the AoCC. The call is established with 
AoCC e-parameters sent in a Facility IE in the CONNECT message, as given below. The UE returns the AoCC 
acknowledgement after the reception of the CONNECT message. It is an implementation option whether the 
AoCC acknowledge is sent by the UE before or after the CONNECT ACKNOWLEDGE. 

b) The call is maintained for 90 s, then terminated by the USS. During the call, the USIM-simulator monitors the 
time intervals between successive INCREMENT commands. As the final INCREMENT command will have 
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occurred as a result of call termination, the time interval calculated since the prior INCREMENT command shall 
be ignored. 

Maximum Duration of Test: 

2 minutes. 

Expected Sequence: 



Step 


Direction 


Message 


Comments 


1 
2 
3 

4 

5 
6 

7 
8 

9 

10 
11 
12 
13 

14 
15 


UE 
UE->USS 
USS->UE 
UE -> USS 

UE->USS 
USS->UE 

UE -> USS 
USS->UE 

UE -> USS 
UE -> USS 
USS -> UE 
USS -> UE 
UE -> USS 

USS -> UE 
USS->UE 


RRC CONNECTION REQUEST 

RRC CONNECTION SETUP 

RRC CONNECTION SETUP 

COMPLETE 

CM SERVICE REQUEST 

AUTHENTICATION REQUEST 

AUTHENTICATION RESPONSE 
SECURITY MODE COMMAND 

SECURITY MODE COMPLETE 

SETUP 

CALL PROCEEDING 

RADIO BEARER SETUP 

RADIO BEARER SETUP 

COMPLETE 

ALERTING 

CONNECT 


The UE is made to initiate a call 

MM procedure, to ensure the successful start of integrity 
in step 8 

RRC procedure, start of integrity is mandatory during call 
setup 

To a supported channel type 

As default message except contains Facility IE with 
contents as indicated in i) below 








Either A or B branch is taken 


A16 
A17 


UE->USS 
UE -> USS 


CONNECT ACKNOWLEDGE 
FACILITY 


As default message except contains Facility IE with 
contents as indicated in ii) below 


B16 
B17 


UE -> USS 
UE->USS 


FACILITY 

CONNECT ACKNOWLEDGE 


As default message except contains Facility IE with 
contents as indicated in ii) below 


18 






call duration 90 s after CAI information sent by USS, 


19 
20 
21 
22 
23 


USS->UE 
UE -> USS 
USS -> UE 
USS -> UE 
UE -> USS 


DISCONNECT 

RELEASE 

RELEASE COMPLETE 

RRC CONNECTION RELEASE 

RRC CONNECTION RELEASE 

COMPLETE 


All connections of RRC are released. 



Specific Message Contents: 

i) FACILITY Information Element with Invoke = ForwardChargelnformation component type as defined in 
TS 24.080[17] subclause 3.6.1 table 3.3. 

For ASN.l description see default message contents in TS 51.010-1 [22], subclause 31.6.4. 

The values of the e-parameters within the parameter part of the Facility Information Element shall be set as below: 

e-parameters: 

parameter: e1 e2 e3 e4 e5 e6 e7 
value 1 1 10 

Values shown in table are in the format and have units as in TS 22.024[8] clause 3. 

ii) FACILITY Information Element with Return Result component type as defined in TS 24.080[17] subclause 
3.6.1 table 3.4. 

For ASN.l description see default message contents TS 51.010-1 [22], in subclause 31.6.4. 
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6.4.2.5 Acceptance criteria 

The UE shall, during a call, send INCREMENT commands to the USIM every 5 s. 

6.4.3 Call terminated when ACM greater than ACMmax 

6.4.3.1 Definition and applicability 

ACMmax gives the maximum value of ACM, at which the current chargeable calls shall be terminated and no further 
calls may be made (except emergency calls). 

This test applies to Terminals accessing UTRAN. Besides of that, this test is applicable only to those Terminals 
supporting AoCC and CS. 

6.4.3.2 Conformance requirement 

ACM shall be incremented by the value of CCM. 

If the ACMmax is valid, and the ACM becomes equal to or exceeds the value of the ACMmax, then all calls in 
progress, chargeable to the user, shall be terminated by the UE, once the chargeable interval determined by the CAI has 
elapsed, (except emergency calls). 

When used the value '1C shall be used as SFI for EF AC m, for compatibility reasons the terminal shall accept other 
values. 

Reference: 

• TS 22.024[8], subclauses 4.2.2 and 4.3 (part h); 

• TS 102 221[5], subclause 14.1.3; 

• TS 31.102[4], subclause 4.2.9, 5.3.4 and Annex H.l. 

6.4.3.3 Test purpose 

1) To verify that the Terminal increments the ACM by the correct number of units, even though this may take 
ACM above ACMmax. 

2) To verify that the Terminal terminates the call. 

3) To verify that the INCREMENT EF ACM command is performed correctly by the terminal. 

4) To verify that the Terminal is able to handle other values then '1C as SFI of EF AC m- 

6.4.3.4 Method of test 
6.4.3.4.1 Initial conditions 

The Terminal shall be connected to a UICC or the USIM simulator, with all elementary files coded as default with the 
exception of: 

EF UST (USIM Service Table) 

Logically: Local Phone Book available; 

User controlled PLMN selector available; 

Fixed dialling numbers available; 

The GSM Access available; 

The Group Identifier level 1 and level 2 not available; 

AoC available. 

Service n 33 (Packed Switched Domain) shall be set to T 

Enabled Services Table available 
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Coding: B1 B2 B3 B4 B5 

binary xxxxxx11 xxxl xxxx xxxxIxOO xxxxxlxx xxxxxx11 

The coding of EF UST shall conform with the capabilities of the USIM used. 
EF A cm (Accumulated call meter) 

Logically: 80 units 

Coding: B1 B2 B3 

binary 0000 0000 0000 0000 01010000 

The SF1 of EF ACM shall be set to '18'. 
EF ACMmax (Accumulated call meter maximum) 

Logically: 94 units 

Coding: B1 B2 B3 

binary 0000 0000 0000 0000 01011110 

The USS transmits on the BCCH, with the following network parameters: 

Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

Access control: unrestricted. 

User Equipment: 

The UE is in MM-state "idle, updated". 

6.4.3.4.2 Procedure 

a) The UE is made to initiate a call. The call establishment shall be performed according to the procedures defined 
in TS 34.108 [21], subclause 7.2.3.2.3 extended by the messages of the AoCC. The call is established with 
AoCC e-parameters sent in a Facility IE in the CONNECT message, as given below. The UE returns the AoCC 
acknowledgement after the reception of the CONNECT message. It is an implementation option whether the 
AoCC acknowledge is sent by the UE before or after the CONNECT ACKNOWLEDGE. 

b) The call is maintained until cleared by the UE (after 30 s). 

c) The contents of ACM are checked. 
Maximum Duration of Test: 

2 minutes. 
Expected Sequence: 
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Step 


Direction 


Message 


Comments 


1 
2 
3 

4 

5 

6 

7 

8 
9 

10 
11 
12 

13 
14 


UE 
UE -> USS 
USS->UE 
UE -> USS 

USS->UE 

UE -> USS 
USS->UE 

UE -> USS 
UE->USS 
USS -> UE 
USS -> UE 
UE -> USS 

USS -> UE 
USS->UE 


RRC CONNECTION REQUEST 
RRC CONNECTION SETUP 
RRC CONNECTION SETUP 
COMPLETE 
AUTHENTICATION REQUEST 

AUTHENTICATION RESPONSE 
SECURITY MODE COMMAND 

SECURITY MODE COMPLETE 

SETUP 

CALL PROCEEDING 

RADIO BEARER SETUP 

RADIO BEARER SETUP 

COMPLETE 

ALERTING 

CONNECT 


The UE is made to initiate a call 

MM procedure, to ensure the successful start of integrity 
in step 8 

RRC procedure, start of integrity is mandatory during call 
setup 

To a supported channel type 

As default message except contains Facility IE with 
contents as indicated in i) below 








Either A or B branch is taken 


A15 
A16 


UE->USS 
UE -> USS 


CONNECT ACKNOWLEDGE 
FACILITY 


As default message except contains Facility IE with 
contents as indicated in ii) below 


B15 
B16 


UE -> USS 
UE->USS 


FACILITY 

CONNECT ACKNOWLEDGE 


As default message except contains Facility IE with 
contents as indicated in ii) below 


17 






call duration 30 s after CAI information sent by USS 


18 
19 
20 
21 
22 


UE -> USS 
USS -> UE 
UE -> USS 
USS -> UE 
UE -> USS 


DISCONNECT 

RELEASE 

RELEASE COMPLETE 

RRC CONNECTION RELEASE 

RRC CONNECTION RELEASE 

COMPLETE 


All connections of RRC are released. 



Specific Message Contents: 

i) FACILITY Information Element with Invoke = ForwardChargelnformation component type as defined in 
TS 24.080[17] subclause 3.6.1 table 3.3. 

For ASN.l description see default message contents in TS 51.010-1 [22], subclause 31.6.4. 

The values of the e-parameters within the parameter part of the Facility Information Element shall be set as below: 

e-parameters: 

parameter: e1 e2 e3 e4 e5 e6 e7 
value 10 10 1 

Values shown in table are in the format and have units as in TS 22.024[8] clause 3. 

ii) FACILITY Information Element with Return Result component type as defined in TS 24.080[17] subclause 
3.6.1 table 3.4. 

For ASN.l description see default message contents in TS 51.010-1 [22], subclause 31.6.4. 

6.4.3.5 Acceptance criteria 

1) The UE shall terminate the call correctly 30 s after CAI was sent. 

2) The value of ACM shall be 100 units. 
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6.4.4 Response codes of increase command of ACM 

6.4.4.1 Definition and applicability 

ACM has a maximum value in terms of coding, and an attempt by the Terminal to exceed that value by sending an 
INCREASE command shall result in an error message from the USIM. As the maximum of the ACM is equal to the 
maximum value of ACMmax, all current chargeable calls shall be terminated and no further calls may be made (except 
emergency calls). 

This test applies to Terminals accessing UTRAN. Besides of that, this test is applicable only to those Terminals 
supporting AoCC and CS. 

6.4.4.2 Conformance requirement 

The Terminal shall perform the increasing procedure, sending the amount to be increased. 

The running accumulated charge shall be stored in the ACM of the USIM. 

Where this charge cannot be stored in the UE, use of the telecommunications service shall be prevented. 

At the time ACM exceeds it's maximum value, then all calls in progress, chargeable to the user, shall be terminated by 
the UE, once the chargeable interval determined by the CAI has elapsed, (except emergency calls). 

When used the value '1C shall be used as SFI for EF ACM , for compatibility reasons the terminal shall accept other 
values. 

References: 

• TS 31.102[4], subclause 4.2.9, 5.3.4 and Annex H.l; 

• TS 22.086[18], subclauses 2.1 and 2.2.1. 

6.4.4.3 Test purpose 

1) To verify that the Terminal clears a charged call if the USIM indicates that the ACM cannot be increased. 

2) To verify that the Terminal is able to handle other values then '1C as SFI of EF ACM . 

6.4.4.4 Method of test 
6.4.4.4.1 Initial conditions 

The Terminal shall be connected to the USIM simulator, with all elementary files coded as default with the exception 
of: 

EF UST (USIM Service Table) 

Logically: Local Phone Book available; 

User controlled PLMN selector available; 

Fixed dialling numbers available; 

The GSM Access available; 

The Group Identifier level 1 and level 2 not available; 

AoC available. 

Service n 33 (Packed Switched Domain) shall be set to T 

Enabled Services Table available 



Coding: 


B1 


B2 


B3 


B4 


B5 


binary 


XXXX XX 1 1 


xxxl xxxx 


xxxx 1 xOO 


xxxx x1 XX 


xxxx XX 1 1 



The coding of EF US t shall conform with the capabilities of the USIM used. 
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EF ACM (Accumulated call meter) 

Logically: (Maximum value - 10) units 

Coding: B1 B2 B3 

binary 11111111 11111111 1111 0101 

The SFI of EF AC M shall be set to '18'. 

EF AC Mmax (Accumulated call meter maximum) 

Logically: (Maximum value - 2) units 

Coding: B1 B2 B3 

binary 11111111 11111111 1111 1101 

The USS transmits on the BCCH, with the following network parameters: 

Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

Access control: unrestricted. 

User Equipment: 

The UE is in MM-state "idle, updated". 



6.4.4.4.2 



Procedure 



a) The UE is made to initiate a call. The call establishment shall be performed according to the procedures defined 
in TS 34.108 [21], subclause 7.2.3.2.3 extended by the messages of the AoCC. The call is established with 
AoCC e-parameters sent in a Facility IE in the CONNECT message, as given below. The UE returns the AoCC 
acknowledgement after the reception of the CONNECT message. It is an implementation option whether the 
AoCC acknowledge is sent by the UE before or after the CONNECT ACKNOWLEDGE. 

b) After an interval has elapsed, the Terminal increments the ACM. When an INCREASE command is received, 
the USIM-simulator sends back the error "98 50". 

c) Conditions are reset to those described in the initial conditions. Steps a) and b) of the test are repeated, except 
that the error code sent by the USIM simulator at step b) is now "6F xx". 

d) Conditions are reset to those described in the initial conditions. Steps a) and b) of the test are repeated, except 
that the error code sent by the USIM simulator at step b) is now "65 81". 

References: 

• TS 102 221[5], subclause 10.2.1. 
Maximum Duration of Test: 
3 minutes. 
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Expected Sequence: 



Step 


Direction 


Message 


Comments 


1 
2 
3 

4 

5 

6 

7 

8 
9 

10 
11 
12 
13 

14 
15 


UE 
UE->USS 
USS->UE 
UE -> USS 

USS->UE 

UE -> USS 
USS->UE 

UE -> USS 

UE -> USS 
USS -> UE 
USS -> UE 
UE -> USS 

USS -> UE 
USS->UE 


RRC CONNECTION REQUEST 
RRC CONNECTION SETUP 
RRC CONNECTION SETUP 
COMPLETE 
AUTHENTICATION REQUEST 

AUTHENTICATION RESPONSE 
SECURITY MODE COMMAND 

SECURITY MODE COMPLETE 

SETUP 

CALL PROCEEDING 

RADIO BEARER SETUP 

RADIO BEARER SETUP 

COMPLETE 

ALERTING 

CONNECT 


The UE is made to initiate a call 

MM procedure, to ensure the successful start of integrity 
in step 8 

RRC procedure, start of integrity is mandatory during call 
setup 

To a supported channel type 

As default message except contains Facility IE with 
contents as indicated in i) below 








Either A or B branch is taken 


A16 
A17 


UE->USS 
UE -> USS 


CONNECT ACKNOWLEDGE 
FACILITY 


As default message except contains Facility IE with 
contents as indicated in ii) below 


B16 
B17 


UE -> USS 
UE->USS 


FACILITY 

CONNECT ACKNOWLEDGE 


As default message except contains Facility IE with 
contents as indicated in ii) below 


18 
19 
20 
21 
22 
23 


UE -> USS 
USS -> UE 
UE -> USS 
USS -> UE 
UE -> USS 


DISCONNECT 

RELEASE 

RELEASE COMPLETE 

RRC CONNECTION RELEASE 

RRC CONNECTION RELEASE 

COMPLETE 


call duration 10s after CAI information sent by USS 
All connections of RRC are released. 



Specific Message Contents: 

i) FACILITY Information Element with Invoke = ForwardChargelnformation component type as defined in 
TS 24.080[17] subclause 3.6.1 table 3.3. 

For ASN.l description see default message contents in TS 51.010-1 [22], subclause 31.6.4. 



The values of the e-parameters within the parameter part of the Facility Information Element shall be set as below: 

e-parameters: 

parameter: e1 e2 e3 e4 e5 e6 e7 
value 20 10 1 

Values shown in table are in the format and have units as in TS 22.024[8] clause 3. 

ii) FACILITY Information Element with Return Result component type as defined in TS 24.080[17] subclause 
3.6.1 table 3.4. 

For ASN.l description see default message contents in TS 51.010-1 [22], subclause 31.6.4. 

6.4.4.5 Acceptance criteria 

1) The UE shall terminate the call correctly 10 s after CAI was sent. 
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2) In each of the three cases, as described in steps b), c) and d) of the procedure, the UE shall terminate the call 
correctly when it receives an indication from the USIM that the ACM cannot be incremented. 

7 PLMN related tests 

7.1 FPLMN handling 

7.1 .1 Adding FPLMN to the Forbidden PLMN list 

7.1 .1 .1 Definition and applicability 

A list of forbidden PLMNs stored in the USIM and providing storage for at least 4 entries is managed by the UE. In 
automatic PLMN selection mode the UE controls registration attempts to appropriate networks with respect to this list 
of forbidden PLMNs. As a result of a registration reject with the cause "PLMN not allowed" the UE stores the PLMN 
which rejected the update request in the USIM. 

The registration attempts initiated by the UE depends on UEs capabilities and can be one of the following: 

I. registration procedures for UEs supporting CS or 

II. registration procedures for UEs supporting PS or 

III. registration procedures for UEs supporting CS/PS 
This test applies to Terminals accessing UTRAN. 

7.1 .1 .2 Conformance requirement 

1) Depending on which domain the UE is going to be registered on, one of the following requirements should be 
fulfilled: 

I. in automatic PLMN selection mode the UE shall only attempt a LOCATION UPDATING REQUEST during 
registration on CS if it receives a BCCH containing a PLMN(MCC,MNC) that is not indicated in the 
EFFPLMN in the USIM or 

II. in automatic PLMN selection mode the UE shall only attempt a ATTACH REQUEST during registration on 
PS if it receives a BCCH containing a PLMN(MCC,MNC) that is not indicated in the EF FPLMN in the USIM 
or 

III. in automatic PLMN selection mode the UE shall only attempt a LOCATION UPDATING REQUEST and/or 
ATTACH REQUEST during registration on CS/PS if it receives a BCCH containing a PLMN(MCC,MNC) 
that is not indicated in the EF FPLMN in the USIM. 

Reference: 

• TS 22.011, subclause 2.3; 

• TS 31.102, subclauses 5.1.1 and 5.2.7. 

2) Depending on which domain the UE is going to be on, one of the following requirements should be fulfilled: 

I. after receipt of a LOCATION UPDATE REJECT message during registration on CS with the cause "PLMN 
not allowed" the Terminal shall update the EFFPLMN in the USIM or 

II. after receipt of a ATTACH REJECT message during registration on PS with the cause "PLMN not allowed" 
the Terminal shall update the EF FPLMN in the USIM or 

III. after receipt of a LOCATION UPDATING REJECT and/or ATTACH REJECT message during registration 
on CS/PS with the cause "PLMN not allowed" the Terminal shall update the EF FPLMN in the USIM. 
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Reference: 

• TS 22.01 1, subclause 3.2.2 ; 

• TS 31.102, subclauses 5.1.1 and 5.2.7. 

3) Depending on which domain the UE is going to be registered on, one of the following requirements should be 
fulfilled: 

I. after registration on CS the USIM shall contain the correct TMSI and location information received by the 
UEor 

II. after registration on PS the USIM shall contain the correct P-TMSI and routing information received by the 
UE or 

III. after registration on CS/PS the USIM shall contain the correct TMSI, P-TMSI, location information and 
routing information received by the UE. 

Reference: 

• TS 31.102, subclauses 5.1.2, 5.2.5 and 5.2.6; 

• TS 21.111 subclause 10.1. 

7.1.1.3 Test purpose 

1) To verify that in automatic PLMN selection mode the UE does not attempt to access PLMNs stored in EF FPLMN 
on the USIM. 

2) To verify that the EF FPLM n is correctly updated by the Terminal after receipt of a 

I. LOCATION UPDATING REJECT message with cause "PLMN not allowed" during registration on CS or. 

II. ATTACH REJECT message with cause "PLMN not allowed" during registration on PS or. 

III. LOCATION UPDATING REJECT and/or ATTACH REJECT message with cause "PLMN not allowed" 
during registration on CS/PS. 

3) To verify that 

I. the EF LO ci has been correctly updated by the Terminal during registration on CS or. 

II. the EFpsloci has been correctly updated by the Terminal during registration on PS or. 

III. the the EF L0CI and EF PSL0CI have been correctly updated by the Terminal during registration on CS/PS. 

7.1.1.4 Method of test 
7.1 .1 .4.1 Initial conditions 

The USS transmits on the BCCH, with the following network parameters: 
Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 234/002/0001. 

- RAI (MCC/MNC/LAC/RAC): 234/002/0001/05. 
Access control: unrestricted. 

The default UICC is used with the following exception: 
EF IMS i(IMSI) 

Logically: 246081111111111 
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Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 

Hex 08 29 64 80 11 11 11 11 11 

EF L0CI (Location Information) 



Logically: 


LAI-MCC: 234 
LAI-MNC: 007 
LAI-LAC: 0000 
TMSI: "32547698" 
















Coding: B1 


B2 B3 B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 32 


54 76 98 


32 


74 


00 


00 


00 


FF 


00 



EF PSL0CI (Packet Switched location Information) 

Logically: RAI-MCC: 234 

RAI-MNC: 007 
RAI-LAC: 0000 
RAI-RAC: 05 
P-TMSI: "32547698" 

P-TMSI signature value: " 1 12233" 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 

Hex 32 54 76 98 11 22 33 32 74 00 00 

B12 B13 B14 

00 05 00 

The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

7.1.1.4.2 Procedure 

a) The UE is powered on. 

b) The USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure 
in the UE. The BCCH is changed to contain: 

PLMN (MCC/MNC): 234/003 

The USS then resumes RF output on the BCCH. 

c) The USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure 
in the UE. The BCCH is changed to contain: 

PLMN (MCC/MNC): 234/004 

The USS then resumes RF output on the BCCH. 

d) The USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure 
in the UE. The BCCH is changed to contain: 

PLMN (MCC/MNC): 234/005 

The USS then resumes RF output on the BCCH. 

e) The USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure 
in the UE. The BCCH is changed to contain: 

LAI (MCC/MNC/LAC): 234/007/0001 

RAI (MCC/MNC/LAC/RAC): 234/007/0001/05 

The USS then resumes RF output on the BCCH. 
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f) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP 
to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

g) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. During registration on CS and after receipt of a LOCATION UPDATING REQUEST from the UE, the USS 
sends LOCATION UPDATING REJECT to the UE with cause "PLMN Not Allowed", followed by RRC 
CONNECTION RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to 
the USS or 

II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS sends ATTACH 
REJECT to the UE with cause "PLMN Not Allowed", followed by RRC CONNECTION RELEASE, 
followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or 

III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or ATTACH 
REQUEST from the UE, the USS sends LOCATION UPDATING REJECT and/or ATTACH REJECT to 
the UE with cause "PLMN Not Allowed", followed by RRC CONNECTION RELEASE, followed by RRC 
CONNECTION RELEASE COMPLETE sent by the UE to the USS. 

The USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure 
in the UE. The BCCH is changed to contain: 

LAI (MCC/MNC/LAC): 234/008/0001 

RAI (MCC/MNC/LAC/RAC): 234/008/0001/05 

The USS then resumes RF output on the BCCH. 

h) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP 
to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

i) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. During registration on CS and Aafter receipt of a LOCATION UPDATINGE REQUEST from the UE, the 
USS initiates authentication, starts integrity by using the security procedure and sends LOCATION 
UPDATINGE ACCEPT to the UE with: 

LAI (MCC/MNC/LAC): 234/008/0001 

TMSI: "43658709" 

II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS initiates 
authentication, starts integrity by using the security procedure and sends ATTACH ACCEPT to the UE with : 

RAI (MCC/MNC/LAC/RAC): 234/008/000/05 

P-TMSI: "43658709" 

P-TMSI signature value "443322" 

III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or ATTACH 
REQUEST from the UE, the USS initiates authentication, starts integrity by using the security procedure and 
sends LOCATION UPDATING ACCEPT and/or ATTACH ACCEPT with some of the following values to 
the UE with : 

LAI (MCC/MNC/LAC): 234/008/0001 

TMSI: "43658709" 

RAI (MCC/MNC/LAC/RAC): 234/008/000/05 

P-TMSI: "43658709" 

P-TMSI signature value "443322" 
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j) After passing through the authentication procedure and after receipt of 

I. TMSI REALLOCATION COMPLETE during registration on CS from the UE the USS sends RRC 
CONNECTION RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to 
the USS or. 

II. ATTACH COMPLETE during registration on PS from the UE, the USS sends RRC CONNECTION 
RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or. 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE during registration on CS/PS from 
the UE, the USS sends RRC CONNECTION RELEASE, followed by RRC CONNECTION RELEASE 
COMPLETE sent by the UE to the USS. 

k) The UE is soft powered down. 

7.1.1.5 Acceptance criteria 

1) After each of the steps a) to d) the UE shall not attempt a LOCATION UPDATE and not a ATTACH procedure. 

2) After step f) the UE shall send 

I. LOCATION UPDATING REQUEST to the USS during registration on CS or 

II. ATTACH REQUEST during registration on PS or 

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on CS/PS. 

3) After step h) the UE shall send 

I. LOCATION UPDATING REQUEST to the USS during registration on CS or 

II. ATTACH REQUEST during registration on PS or 

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on CS/PS. 

4) After step i) the UE shall respond with 

I. TMSI REALLOCATION COMPLETE to the USS during registration on CS or 

II. ATTACH COMPLETE during registration on PS or 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE to the USS during registration on 
CS/PS. 

5) After step k) the USIM shall contain the following values: 
EF F p L MN (Forbidden PLMNs) 



Logically: 


PLMN1 




234 002 (MCC MNC) 
















PLMN2 




234 003 




















PLMN3 




234 004 




















PLMN4 




234 005 




















PLMN5 




234 006 




















PLMN6 




234 007 


















Coding: B1 


B2 B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


Hex 32 


24 00 


32 


34 


00 


32 


44 


00 


32 


54 


00 


B13 


B14 B15 


B16 


B17 


B18 














32 


64 


00 


32 


74 


00 















For UEs supporting (CS and PS) or (CS only): 
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EF L0CI (Location 


Information) 
















Logically: 


LAI-MCC: 234 
LAI-MNC: 008 
TMSI: "43658709" 
















Coding: B1 


B2 B3 B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 43 


65 87 09 


32 


84 


00 


XX 


XX 


XX 


00 



For UEs supporting (CS and PS) or (PS only): 
EF PSL0CI (Location Information) 



Logi 


cally: 


RAI-MCC: 234 
RAI-MNC: 008 




















P-TMSI: 


"43658709" 
















Coding: 


B1 


B2 


B3 B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 


43 


65 


87 09 


XX 


XX 


XX 


32 


84 


00 


XX 


Coding: 


B12 


B13 


B14 
















Hex 


XX 


XX 


00 

















7.1 .2 UE updating forbidden PLMNs 

7.1 .2.1 Definition and applicability 

A list of forbidden PLMNs stored in the USIM provides storage for at least 4 entries, and is managed by the UE. In 
automatic PLMN selection mode the UE controls registration attempts to appropriate networks with respect to this list 
of forbidden PLMNs. As a result of a registration reject with the cause "PLMN not allowed" the UE stores the PLMN 
which rejected the update request in the USIM. 

The registration attempts initiated by the UE depends on UEs capabilities and can be one of the following: 

I. registration procedures for UEs supporting CS or 

II. registration procedures for UEs supporting PS or 

III. registration procedures for UEs supporting CS/PS 
This test applies to Terminals accessing UTRAN. 

7.1.2.2 Conformance requirement 

Depending on which domain the UE will be registered on, one of the following requirements should be fulfilled: 

I. after the receipt of a LOCATION UPDATING REJECT message during registration on CS with the cause 
"PLMN not allowed" the UE shall update the EFFPLMN in the USIM or 

II. after receipt of a ATTACH REJECT message during registration on PS with the cause "PLMN not allowed" the 
Terminal shall update the EFFPLMN in the USIM or 

III. after receipt of a LOCATION UPDATING REJECT and/or ATTACH REJECT message during registration on 
CS/PS with the cause "PLMN not allowed" the Terminal shall update the EFFPLMN in the USIM. 

Reference: 

• TS 22.01 1, subclause 3.2.2.4. 

• TS 31.102, subclauses 5.1.1 and 5.2.7. 
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7.1.2.3 Test purpose 

To verify that the UE correctly updates the EF FPLMN , i.e. fill up existing gaps in the elementary file before overwriting 
any existing entries. 

7.1.2.4 Method of test 
7.1.2.4.1 Initial conditions 

The USS transmits on the BCCH, with the following network parameters: 
Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 234/002/0001. 

- RAI (MCC/MNC/LAC/RAC): 234/002/0001/05 
Access control: unrestricted. 

The default UICC is used with the following exception: 
EF FPLMN (Forbidden PLMNs) 



Logically: 


PLMN1 




234 001 (MCC MNC) 
















PLMN2 




empty 




















PLMN3 




234 003 




















PLMN4 




234 004 




















PLMN5 




234 005 




















PLMN6 




234 006 


















Coding: B1 


B2 B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


Hex 32 


14 00 


FF 


FF 


FF 


32 


34 


00 


32 


44 


00 


B13 


B14 B15 


B16 


B17 


B18 














32 


54 


00 


32 


64 


00 















The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

7.1.2.4.2 Procedure 

a) The UE is powered on. 

b) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP 
to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

c) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. During registration on CS and after receipt of a LOCATION UPDATING REQUEST from the UE, the USS 
sends LOCATION UPDATING REJECT to the UE with the cause "PLMN not allowed", followed by RRC 
CONNECTION RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to 
the USS or 

II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS sends ATTACH 
REJECT to the UE with cause "PLMN Not Allowed", followed by RRC CONNECTION RELEASE, 
followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or 

III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or ATTACH 
REQUEST from the UE, the USS sends LOCATION UPDATING REJECT and/or ATTACH REJECT to 
the UE with cause "PLMN Not Allowed", followed by RRC CONNECTION RELEASE, followed by RRC 
CONNECTION RELEASE COMPLETE sent by the UE to the USS. 

d) The UE is soft powered down. 
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7.1 .2.5 Acceptance criteria 

1) After step b) the UE shall send 

I. LOCATION UPDATING REQUEST to the USS during registration on CS or 

II. ATTACH REQUEST during registration on PS or 

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on CS/PS. 

2) After step d) the USIM shall contain: 
EF F p L MN (Forbidden PLMNs) 



Logically: 


PLMN1 




234 001 (MCC MNC) 
















PLMN2 




234 002 




















PLMN3 




234 003 




















PLMN4 




234 004 




















PLMN5 




234 005 




















PLMN6 




234 006 


















Coding: B1 


B2 B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


Hex 32 


14 00 


32 


24 


00 


32 


34 


00 


32 


44 


00 


B13 


B14 B15 


B16 


B17 


B18 














32 


54 


00 


32 


64 


00 















EF FPLMN (Forbidden PLMNs) 



Logically: 


PLMN1 




234 001 (MCC MNC) 
















PLMN2 




234 003 




















PLMN3 




234 004 




















PLMN4 




234 005 




















PLMN5 




234 006 




















PLMN6 




234 002 


















Coding: B1 


B2 B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


Hex 32 


14 00 


32 


34 


00 


32 


44 


00 


32 


54 


00 


B13 


B14 B15 


B16 


B17 


B18 














32 


64 


00 


32 


24 


00 















7.1 .3 UE deleting forbidden PLMNs 



7.1.3.1 



Definition and applicability 



In manual PLMN selection mode the UE allows registration attempts to all available PLMNs, including forbidden 
PLMNs (as indicated by the forbidden PLMN list on the USIM). As a result of a successful registration procedure onto 
a PLMN which is in the forbidden PLMN list, the forbidden PLMN list is automatically updated by the UE. 

The registration attempts initiated by the UE depends on UEs capabilities and can be one of the following: 

I. registration procedures for UEs supporting CS or 

II. registration procedures for UEs supporting PS or 

III. registration procedures for UEs supporting CS/PS 
This test applies to Terminals accessing UTRAN. 



ETSI 



3GPP TS 31.121 version 4.13.0 Release 4 83 ETSI TS 131 121 V4.13.0 (2005-10) 

7.1.3.2 Conformance requirement 

1) Depending on which domain the UE will be registered on, one of the following requirements should be fulfilled: 

I. In manual PLMN selection mode the UE shall be able to perform a LOCATION UPDATING attempt during 
registration on CS to a PLMN which is in the forbidden PLMN list or 

II. In manual PLMN selection mode the UE shall be able to perform a ATTACH attempt during registration on 
PS to a PLMN which is in the forbidden PLMN list or 

III. In manual PLMN selection mode the UE shall be able to perform a LOCATION UPDATING and/or 
ATTACH attempt during registration on CS/PS to a PLMN which is in the forbidden PLMN list. 

• TS 22.01 1, subclause 3.2.2.2. 

2) Depending on which domain the UE is going to be registered on, one of the following requirements should be 
fulfilled: 

I. after receipt of LOCATION UPDATING ACCEPT message during registration on CS the UE shall delete 
the forbidden PLMN from the forbidden PLMN list OR 

II. after receipt of ATTACH ACCEPT message during registration on PS the UE shall delete the forbidden 
PLMN from the forbidden PLMN list or 

III. after receipt of LOCATION UPDATING ACCEPT and/or ATTCH ACCEPT message during registration on 
CS/PS the UE shall delete the forbidden PLMN from the forbidden PLMN list. 

• TS 22.01 1, subclause 3.2.2.4. 

7.1.3.3 Test purpose 

1) To verify that the UE is able to perform 

I. a LOCATION UPDATING REQUEST during registration on CS on a forbidden PLMN in manual PLMN 
selection mode or 

II. a ATTACH REQUEST during registration on PS on a forbidden PLMN in manual PLMN selection mode or 

III. a LOCATION UPDATING REQUEST and/or ATTACH REQUEST during registration on CS/PS on a 
forbidden PLMN in manual PLMN selection mode: 

2) To verify that the UE after a successful registration attempt deletes the PLMN in the EF FPLMN on the USIM. 

7.1.3.4 Method of test 
7.1.3.4.1 Initial conditions 

The USS transmits on the BCCH, with the following network parameters: 
Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 234/005/0001. 

- RAI (MCC/MNC/LAC/RAC): 234/005/0001/05. 
Access control: unrestricted. 

The default UICC is used with the following exception: 
EF F p L mn (Forbidden PLMNs) 
Logically: 



PLMN1 


empty 


PLMN2 


empty 


PLMN3 


empty 


PLMN4 


empty 
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PLMN5 




234 005 (MCC MNC) 


















PLMN6 




empty 


















Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


Hex 


FF 

B13 
32 


FF 

B14 
54 


FF 

B15 

00 


FF 

B16 
FF 


FF 

B17 

FF 


FF 

B18 

FF 


FF 


FF 


FF 


FF 


FF 


FF 



The UICC is installed into the Terminal and the UE is set to manual PLMN selection mode. 

7.1.3.4.2 Procedure 

a) The UE is powered on. 

b) PLMN with MCC/MNC of 234/005 is manually selected. 

c) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP 
to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

d) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. During registration on CS and After after receipt of a LOCATION UPDATINGE REQUEST from the 
UE, the USS initiates authentication, starts integrity by using the security procedure and sends 
LOCATION UPDATEING ACCEPT with to the UE: 

LAI (MCC/MNC/LAC): 234/005/0001 

TMSI: "12345678" 

II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS initiates 
authentication, starts integrity by using the security procedure and sends ATTACH ACCEPT with to 
theUE: 

RAI (MCC/MNC/LAC): 234/005/0001/05 

P-TMSI: "12345678" 

P-TMSI signature value "AB1234" 

III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or 
ATTACH REQUEST from the UE, the USS initiates authentication, starts integrity by using the 
security procedure and sends LOCATION UPDATING ACCEPT and/or ATTACH ACCEPT with 
some of the following values to the UE with: 

LAI (MCC/MNC/LAC): 234/005/0001 

TMSI: "12345678" 



RAI (MCC/MNC/LAC): 234/005/0001/05 
P-TMSI: "12345678" 

P-TMSI signature value "AB1234" 
e) After passing through the authentication procedure and after receipt of 

I. TMSI REALLOCATION COMPLETE during registration on CS from the UE, the USS sends RRC 
CONNECTION RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the 
UE to the USS or. 

II. ATTACH COMPLETE during registration on PS from the UE, the USS sends RRC CONNECTION 
RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or. 
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III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE during registration on CS/PS 
from the UE, the USS sends RRC CONNECTION RELEASE, followed by RRC CONNECTION 
RELEASE COMPLETE sent by the UE to the US S . 

f) The UE is soft powered down. 

7.1 .3.5 Acceptance criteria 

1) After step c) the UE shall send 

I. LOCATION UPDATING REQUEST to the USS during registration on CS or 

II. ATTACH REQUEST during registration on PS or 

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on 
CS/PS. 

2) After step d) the UE shall respond with 

I. TMSI REALLOCATION COMPLETE to the USS during registration on CS or 

II. ATTACH COMPLETE during registration on PS or 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE to the USS during registration 
on CS/PS. 

3) After step f) the USIM shall contain the following values: 
EF F p L mn (Forbidden PLMNs) 



Logically: 


PLMNl 
PLMN2 
PLMN3 
PLMN4 
PLMN5 
PLMN6 




empty 
empty 
empty 
empty 
empty 
empty 


















Coding: B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


Hex FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


B13 


B14 


B15 


B16 


B17 


B18 














FF 


FF 


FF 


FF 


FF 


FF 















For UEs supporting CS only or CS/PS : 

EF L0CI (Location Information) 

Logically: LAI-MCC: 234 

LAI-MNC: 005 
TMSI: "12345678" 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 


12 


34 


56 


78 


32 


54 


00 


XX 


XX 


XX 


00 



For UEs supporting PS only or CS/PS : 

EF PSL0CI (Location Information) 

Logically: RAI-MCC: 234 

RAI-MNC: 005 
P-TMSI: "12345678" 
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Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 

Hex 12 34 56 78 xx xx xx 32 54 00 xx 

Coding: B12 B13 B14 

Hex xx xx 00 



7.2 User controlled PLMN selector handling 

7.2.1 UE updating the User controlled PLMN selector list 

7.2.1 .1 Definition and applicability 

The User controlled PLMN selector list gives in priority order the preferred UPLMNs on which the UE shall register. 
The Radio Access Technology identifier defines the Radio network in which the UE shall register. The list is stored on 
the USIM in the EF PLM nwact- Update and deletion of PLMNs may be performed by the subscriber. 

This test applies to Terminals accessing UTRAN. 

7.2.1.2 Conformance requirement 

The UE shall correctly replace the selected UPLMN in the User controlled PLMN selector list. 
• TS 31.102, subclause 5.3.6. 

7.2.1.3 Test purpose 

To verify that the UE correctly updates the EF PLMNwACT . 

7.2.1.4 Method of test 

7.2.1.4.1 Initial conditions 

No USS is required for this test. 

The default UICC is used. 

The UICC is installed into the Terminal and the UE is powered on. 

7.2.1.4.2 Procedure 

a) The user shall initiate an MMI dependent procedure to change the second UPLMN in the User controlled PLMN 
selector list to MCC/MNC of 567/002, the ACT identifier shall set to UTRAN only. 

b) The UE is soft powered down. 

7.2.1 .5 Acceptance criteria 

After step b) the USIM shall contain the following values: 



plmnwact (UPLMN Selector) 




Logically: 1 st PLMN: 


244 081 (MCCMNC) 


1 st ACT: 


UTRAN 


2 nd PLMN: 


567 002 


2 nd ACT 


UTRAN 


3 rd PLMN: 


244 082 


3 rd ACT 


UTRAN 


4 th PLMN: 


244 082 


4 th ACT 


GSM 
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5™ 


PLMN: 


244 003 


























5 th 


ACT 


UTRAN 


























6 th 


PLMN: 


244 004 


























6 th 


ACT 


UTRAN 


























-7 til 


PLMN: 


244 005 


























-7 til 


ACT 


UTRAN 


























8 th 


PLMN: 


244 006 


























8 th 


ACT 


UTRAN 


























9 lh 


PLMN: 


244 007 


























9 lh 


ACT 


UTRAN 


























10 


* PLMN: 


244 008 


























10 


111 ACT 


UTRAN 


























11 


th PLMN: 


244 009 


























11 


""ACT 


UTRAN 


























12 


* PLMN: 


244 010 


























12 


111 ACT 


UTRAN 






















Coding: 


B1 


B2 


B3 


B4 B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


B13 


B14 


B15 


Hex 


42 


14 


80 


80 00 


65 


27 


00 


80 


00 


42 


24 


80 


80 


00 




B16 


B17 


B18 


B19 B20 


B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 




42 


24 


80 


00 80 


42 


34 


00 


80 


00 


42 


44 


00 


80 


00 




B31 


B32 


B33 


B34 B35 


B36 


B37 


B38 


B39 


B40 


B41 


B42 


B43 


B44 


B45 




42 


54 


00 


80 00 


42 


64 


00 


80 


00 


42 


74 


00 


80 


00 




B46 


B47 


B48 


B49 B50 


B51 


B52 


B53 


B54 


B55 


B56 


B57 


B58 


B59 


B60 




42 


84 


00 


80 00 


42 


94 


00 


80 


00 


42 


04 


10 


80 


00 



7.2.2 UE recognising the priority order of the User controlled PLMN 
selector list with the same access technology. 

7.2.2.1 Definition and applicability 

The User controlled PLMN selector list gives in priority order the preferred UPLMNs on which the UE shall register. 
The Radio Access Technology identifier defines the Radio network in which the UE shall register. The list is stored on 
the USIM in the EF PLM nwact- Update and deletion of UPLMNs may be performed by the subscriber by the use of the 
PIN. 

The registration attempts initiated by the UE depends on UEs capabilities and can be one of the following: 

I. registration procedures for UEs supporting CS or 

II. registration procedures for UEs supporting PS or 

III. registration procedures for UEs supporting CS/PS 



This test applies to Terminals accessing UTRAN. 

7.2.2.2 Conformance requirement 

When registering onto a VPLMN the UE shall take into account the priority order of the UPLMNs in the preferred list 
on the USIM. 

• TS 22.01 1, subclause 3.2.2. 
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7.2.2.3 Test purpose 

To verify that the UPLMN with the higher priority (defined by its position in EF PLMNwACT ) takes precedence over the 
UPLMN with the lower priority when the UE performs a network selection. 

7.2.2.4 Method of test 
7.2.2.4.1 Initial conditions 

The USS transmits on two BCCHs, with the following network parameters: 
Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/033/0001. 

- RAI (MCC/MNC/LAC/RAC): 244/033/0001/05. 
Access control: unrestricted. 

Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/034/0001. 

- RAI (MCC/MNC/LAC/RAC): 244/034/0001/05. 
Access control: unrestricted. 

The default UICC is used with the following exception: 
EF PLMNwACT (UPLMN Selector with Access Technology) 
Logically: 



1 st PLMN: 


244 081 (MCCMNC) 


1 st ACT: 


UTRAN 


2 nd PLMN: 


244 081 


2 nd ACT 


GSM 


3 rd PLMN: 


244 082 


3 rd ACT 


UTRAN 


3 rd PLMN: 


244 082 


3 rd ACT 


GSM 


10 th PLMN: 


244 008 


10 th ACT 


UTRAN 


11 th PLMN: 


244 034 


11 th ACT 


UTRAN 


12 th PLMN: 


244 033 



12 th ACT UTRAN 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 B12 B13 B14 B15 

Hex 42 14 80 80 00 42 14 80 00 80 42 24 80 80 00 

B16 B17 B18 B19 B20 

42 24 80 00 80 



B46 B47 B48 B49 B50 B51 B52 B53 B54 B55 B56 B57 B58 B59 B60 
42 84 00 80 00 42 44 30 80 00 42 34 30 80 00 

The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

7.2.2.4.2 Procedure 

a) The UE is powered on. 
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b) After receipt on the cell related to the BCCH transmitting MCC/MNC 244/034 of a RRC CONNECTION 
REQUEST from the UE, the USS sends RRC CONNECTION SETUP to the UE, followed by RRC 
CONNECTION SETUP COMPLETE sent by the UE to the US S . 

c) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. During registration on CS and after After receipt of a LOCATION UPDATEING REQUEST from the 
UE, the USS initiates authentication, starts integrity by using the security procedure and sends 
LOCATION UPDATEING ACCEPT to the UE with the following values: 

LAI (MCC/MNC/LAC): 244/034/0001 

TMSI: "34567890" 

II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS initiates 
authentication, starts integrity by using the security procedure and sends ATTACH ACCEPT to the 
UE with the following values : 

RAI (MCC/MNC/LAC/RAC) 244/034/0001/05 

P-TMSI "34567890" 

P-TMSI signature value "AB1234" 

III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or 
ATTACH REQUEST from the UE, the USS initiates authentication, starts integrity by using the 
security procedure and sends LOCATION UPDATING ACCEPT and/or ATTACH ACCEPT to the 
UE with some of the following values : 



LAI (MCC/MNC/LAC): 244/034/0001 
TMSI: "34567890" 

RAI (MCC/MNC/LAC/RAC) 244/034/0001/05 

P-TMSI "34567890" 

P-TMSI signature value "AB1234" 

d) After passing through the authentication procedure and after receipt of a 

I. TMSI REALLOCATION COMPLETE during registration on CS from the UE, the USS sends RRC 
CONNECTION RELEASE , followed by RRC CONNECTION RELEASE COMPLETE sent by the 
UE to the USS or 

II. ATTACH COMPLETE during registration on PS from the UE, the USS sends RRC CONNECTION 
RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or. 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE during registration on CS/PS 
from the UE, the USS sends RRC CONNECTION RELEASE, followed by RRC CONNECTION 
RELEASE COMPLETE sent by the UE to the USS. 

e) The UE is soft powered down. 
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7.2.2.5 Acceptance criteria 

1) After step a) the UE shall send an RRC CONNECTION REQUEST on the cell related to the BCCH transmitting 

MCC/MNC 244/034 to the USS. 

2) After step b) the UE shall send 

I. LOCATION UPDATING REQUEST to the USS during registration on CS or 

II. ATTACH REQUEST to the USS during registration on PS or 

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on 
CS/PS. 



3) After step c) the UE shall respond with 

I. TMSI REALLOCATION COMPLETE to the USS during registration on CS or 

II. ATTACH COMPLETE during registration on PS or 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE to the USS during registration 
on CS/PS.. 

4) After step e) the USIM shall contain the following values: 

For UEs supporting (CS and PS) or (CS only): 
EF LO ci (Location Information) 



Logically: 


LAI-MCC: 244 
LAI-MNC: 034 
TMSI: "34567890" 
















Coding: Bl 


B2 B3 B4 


B5 


B6 


B7 


B8 


B9 


B10 


Bll 


Hex 34 


56 78 90 


42 


44 


30 


XX 


XX 


XX 


00 



For UEs supporting (CS and PS) or (PS only): 
EFpsloci (Location Information) 



Log] 


cally: 


RAI-MCC: 244 
RAI-MNC: 034 




















P-TMSI: 


"34567890" 
















Coding: 


B1 


B2 


B3 B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 


34 


56 


78 90 


XX 


XX 


XX 


42 


44 


30 


XX 


Coding: 


B12 


B13 


B14 
















Hex 


XX 


XX 


00 

















7.2.3 UE recognising the priority order of the User controlled PLMN 
selector list using a ACT preference. 

7.2.3.1 Definition and applicability 

The User controlled PLMN selector list gives in priority order the preferred PLMNs of the User on which the UE shall 
register. The Radio Access Technology identifier defines the Radio network in which the UE shall register. The list is 
stored on the USIM in the EF PLMNwACT . Update and deletion of User controlled PLMNs may be performed by the 
subscriber by the use of the PIN. 
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This test applies to a GSM/UMTS dual mode UE accessing both UTRAN and GSM. 

7.2.3.2 Conformance requirement 

When registering onto a VPLMN the UE shall take into account the priority of the ACT identifier in the preferred list 
ontheUSIM. 

• TS 22.01 1, subclause 3.2.2; 

• TS 31.102, subclauses 4.2.5 and 5. 1.2. 

7.2.3.2.1 Test purpose 

To verify that the ACT with the higher priority (defined by its position in EF PLMNwACT ) takes precedence over the 
UPLMN with the lower priority when the UE performs a network selection. 

7.2.3.3 Method of test 

7.2.3.3.1 Initial conditions 

For this test both a GSM SS and a UTRAN USS is needed. 
The GSM SS transmit on BCCH, with the following network parameters: 
Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/081/0001. 
Access control: unrestricted. 

The UMTS USS transmit on BCCH, with the following network parameters: 
Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/082/0001. 
Access control: unrestricted. 

The default UICC is used. 

The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

7.2.3.3.2 Procedure 

a) The UE is powered on. 

b) After receipt on the GSM-cell related to the BCCH transmitting MCC/MNC 244/081 of a CHANNEL 
REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the UE. 

c) After receipt of a LOCATION UPDATING REQUEST from the UE, the SS sends LOCATION UPDATING 
ACCEPT with: 

LAI (MCC/MNC): 244/081 

TMSI: "34567890" 

to the UE. 

d) After receipt of a TMSI REALLOCATION COMPLETE from the UE, the SS sends CHANNEL RELEASE to 
the UE. 

e) The UE is soft powered down. 
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7.2.3.4 Acceptance criteria 

1.) After step a) the UE shall send a CHANNEL REQUEST on the GSM-cell related to the BCCH transmitting 
MCC/MNC 244/08 1 to the SS. 

2) After step b) the UE shall send LOCATION UPDATING REQUEST to the SS. 

3) After step c) the UE shall respond with TMSI REALLOCATION COMPLETE. 

4) After step e) the USIM shall contain the following values: 

EF L0CI (Location Information) 

Logically: LAI-MCC: 244 

LAI-MNC: 081 
TMSI: "34567890" 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 


34 


56 


78 


90 


42 


14 


80 


XX 


XX 


XX 


00 



7.2.4 Void 

7.3 Operator controlled PLMN selector handling 

7.3.1 UE recognising the priority order of the Operator controlled PLMN 
selector list. 

7.3.1 .1 Definition and applicability 



The Operator controlled PLMN selector list gives in priority order the preferred OPLMNs on which the UE shall 
register if no network of the User controlled PLMN selector list is available. The Radio Access Technology identifier 
defines the Radio network in which the UE shall register. The list is stored on the USIM in the EFqplmnwact- Update 
and deletion of OPLMNs shall not be possible by the subscriber by the use of the PIN. 

The registration attempts initiated by the UE depends on UEs capabilities and can be one of the following: 

I. registration procedures for UEs supporting CS or 

II. registration procedures for UEs supporting PS or 

III. registration procedures for UEs supporting CS/PS 

This test applies to Terminals accessing UTRAN. 

7.3.1.2 Conformance requirement 

When registering onto a VPLMN the UE shall take into account the priority of OPLMNs in the preferred list on the 
USIM. 

• TS 22.01 1, subclause 3.2.2; 

• TS 31.102, subclause 4.2.53. 

7.3.1.3 Test purpose 

To verify that the OPLMN with the higher priority (defined by its position in EF plmnwact) takes precedence over the 
OPLMN with the lower priority when the UE performs a network selection. 
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7.3.1.4 Method of test 

7.3.1.4.1 Initial conditions 

For this test a USS is needed. 

The USS transmits on two BCCHs, with the following network parameters: 
Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 254/01 1/000 

- RAI (MCC/MNC/LAC/RAC): 254/011/0001/05.1. 
Access control: unrestricted. 
Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 254/012/0001. 

- RAI (MCC/MNC/LAC/RAC): 254/012/0001/05. 
Access control: unrestricted. 

The default UICC is used with the following exceptions: 

EF UST (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 

Fixed dialling numbers available 

Barred dialling numbers available 

The GSM Access available 

The Group Identifier level 1 and level 2 not available 

Service n 33 (Packed Switched Domain) shall be set to T 

Enabled Services Table available 

Operator controlled PLMN selector available 

Coding: B1 B2 B3 B4 B5 B6 

binary xx1 x xx1 1 xxxx xxxx xxxx 1 xOO xxxx x1 xx xxxx xx1 1 xxxx xx1 x 

The coding of EF US t shall conform with the capabilities of the USIM used. 
EFoplmnwact (OPLMN Selector) 
Logically: 



1 st PLMN: 


254 012 (MCC MNC) 


1 st ACT 


UTRAN 


2 nd PLMN: 


254 011 


2 nd ACT 


UTRAN 


3 rd PLMN: 


254 002 


3 rd ACT: 


UTRAN 


4 th PLMN: 


254 003 


4 th ACT: 


UTRAN 


5 th PLMN: 


254 004 


5 th ACT: 


UTRAN 


6 th PLMN: 


254 005 


6 th ACT: 


UTRAN 


7 th PLMN: 


254 006 


7 th ACT: 


UTRAN 


8 th PLMN: 


254 007 


8 th ACT: 


UTRAN 
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Coding: 


B01 


B02 


B03 


B04 


B05 


B06 


B07 


B08 


B09 


B10 


Hex 


52 


24 


10 


80 


00 


52 


14 


10 


80 


00 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 




52 


24 


00 


80 


00 


52 


34 


00 


80 


00 




B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 




52 


44 


00 


80 


00 


52 


54 


00 


80 


00 




B31 


B32 


B33 


B34 


B35 


B36 


B37 


B38 


B39 


B40 




52 


64 


00 


80 


00 


52 


74 


00 


80 


00 



The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

7.3.1.4.2 Procedure 

a) The UE is powered on. 

b) After receipt on the cell related to the BCCH transmitting MCC/MNC 254/012 of a RRC CONNECTION 
REQUEST from the UE, the USS sends RRC CONNECTION SETUP to the UE, followed by RRC 
CONNECTION SETUP COMPLETE sent by the UE to the USS. 

c) Depending on which domain the UE is going to be registered on, one of the following requirements should be 
fulfilled: 

I. During registration on CS and After after receipt of a LOCATION UPDATEING REQUEST from the 
UE, the USS initiates authentication, starts integrity by using the security procedure and sends 
LOCATION UPDATEING ACCEPT to the UE with following values: 

LAI (MCC/MNC/LAC): 254/012/0001 

TMSI: "34567890" 

II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS initiates 
authentication, starts integrity by using the security procedure and sends ATTACH ACCEPT to the 
UE.with following values : 

RAI (MCC/MNC/LAC/RAC) 254/012/0001/05 

P-TMSI "34567890" 

P-TMSI signature value "AB1234" 

III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or 
ATTACH REQUEST from the UE, the USS initiates authentication, starts integrity by using the 
security procedure and sends LOCATION UPDATING ACCEPT and/or ATTACH ACCEPT to the 
UE.with some of the following values : 



LAI (MCC/MNC): 254/012/0001 
TMSI: "34567890" 

RAI (MCC/MNC/LAC/RAC) 254/012/0001/05 

P-TMSI "34567890" 

P-TMSI signature value " AB 1234" 

d) After receipt of a 

I. TMSI REALLOCATION COMPLETE during registration on CS from the UE, the USS sends RRC 
CONNECTION RELEASE to the UE, followed by RRC CONNECTION RELEASE COMPLETE 
sent by the UE to the USS. 
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II. ATTACH COMPLETE during registration on PS from the UE, the USS sends RRC CONNECTION 
RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or. 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE during registration on CS/PS 
from the UE, the USS sends RRC CONNECTION RELEASE, followed by RRC CONNECTION 
RELEASE COMPLETE sent by the UE to the USS. 

e) The UE is soft powered down. 

7.3.1 .5 Acceptance criteria 

1) After step a) the UE shall send an RRC CONNECTION REQUEST on the cell related to the BCCH transmitting 

MCC/MNC 254/012 to the USS. 

2) After step b) the UE shall send 

I. LOCATION UPDATING REQUEST to the USS during registration on CS or 

II. ATTACH REQUEST, to the USS during registration on PS or 

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on 
CS/PS. 



3) After step c) the UE shall respond with 

I. TMSI REALLOCATION COMPLETE during registration on CS or 

II. ATTACH COMPLETE during registration on PS or 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE to the USS during registration 
on CS/PS.. 

4) After step e) the USIM shall contain the following values: 

For UEs supporting (CS and PS) or (CS only): 

EF L oci (Location Information) 

Logically: LAI-MCC: 254 

LAI-MNC: 012 
TMSI: "34567890" 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 


34 


56 


78 


90 


52 


24 


10 


XX 


XX 


XX 


00 



For UEs supporting (CS and PS) or (PS only): 
EF PSL0CI (Location Information) 



Logi 


ically: 


RAI-MCC: 254 
RAI-MNC: 012 




















P-TMSI: 


"34567890" 
















Coding: 


B1 


B2 


B3 B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 


34 


56 


78 90 


XX 


XX 


XX 


52 


24 


10 


XX 


Coding: 


B12 


B13 


B14 
















Hex 


XX 


XX 


00 
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7.3.2 UE recognising the priority order of the User controlled PLMN 
selector over the Operator controlled PLMN selector list. 

7.3.2.1 Definition and applicability 

The User controlled PLMN selector list has a higher priority as the OPLMN selector list on which the UE shall 
register. The Radio Access Technology identifier defines the Radio network in which the UE shall register. The list is 
stored on the USIM in the EF PLMNwAC t- 

The registration attempts initiated by the UE depends on UEs capabilities and can be one of the following: 

I. registration procedures for UEs supporting CS or 

II. registration procedures for UEs supporting PS or 

III. registration procedures for UEs supporting CS/PS 
This test applies to Terminals accessing UTRAN. 

7.3.2.2 Conformance requirement 

When registering onto a VPLMN the UE shall take into account the priority of UPLMNs first before the OPLMNs in 
the preferred list on the USIM. 

• TS 22.01 1, subclause 3.2.2.2; 

• TS 31.102, subclauses 4.2.5 and 4.2.53. 

7.3.2.3 Test purpose 

To verify that the User controlled PLMN with a lower priority (defined by its position in EF PLM nwact) takes precedence 
over the OPLMN with a higher priority when the UE performs a network selection. 

7.3.2.4 Method of test 
7.3.2.4.1 Initial conditions 

For this test a USS is needed. 

The USS transmits on two BCCHs, with the following network parameters: 
Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 254/001/0001. 

- RAI (MCC/MNC/LAC/RAC): 254/001/0001/05. 
Access control: unrestricted. 
Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/010/0001. 

- RAI (MCC/MNC/LAC/RAC): 244/010/0001/05. 
Access control: unrestricted. 

The default UICC is used with the following exception: 
EF UST (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 
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Fixed dialling numbers available 

Barred dialling numbers available 

The GSM Access available 

The Group Identifier level 1 and level 2 not available 

Service n 33 (Packed Switched Domain) shall be set to T 

Enabled Services Table available 

Operator controlled PLMN selector available 

Coding: B1 B2 B3 B4 B5 B6 

binary xx1 x xx1 1 xxxx xxxx xxxx 1 xOO xxxx x1 xx xxxx xx1 1 xxxx xx1 x 

The coding of EF US t shall conform with the capabilities of the USIM used. 
The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

7.3.2.4.2 Procedure 

a) The UE is powered on. 

b) After receipt on the cell related to the BCCH transmitting MCC/MNC 244/010 of a RRC CONNECTION 
REQUEST from the UE, the USS sends RRC CONNECTION SETUP to the UE, followed by RRC 
CONNECTION SETUP COMPLETE sent by the UE to the USS. 

c) Depending on which domain the UE is going to be registered on , one of the following requirements should be 
fulfilled: 

I. During registration on CS and afterAfter receipt of a LOCATION UPDATEING REQUEST from the 
UE, the USS initiates authentication, starts integrity by using the security procedure and sends 
LOCATION UPDATEING ACCEPT with the following values : 

LAI (MCC/MNC/LAC): 244/010/0001 

TMSI: "34567890" 



II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS initiates 
authentication, starts integrity by using the security procedure and sends ATTACH ACCEPT with the 
following values : 

RAI (MCC/MNC/LAC/RAC) 244/010/0001/05 

P-TMSI "34567890" 

P-TMSI signature value "AB1234" 



III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or 
ATTACH REQUEST from the UE, the USS initiates authentication, starts integrity by using the 
security procedure and sends LOCATION UPDATING ACCEPT and/or ATTACH ACCEPT with 
some of the following values : 

LAI (MCC/MNC/LAC): 244/010/0001 

TMSI: "34567890" 



RAI (MCC/MNC/LAC/RAC) 244/010/0001/05 
P-TMSI "34567890" 

P-TMSI signature value " AB 1234" 
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d) After receipt of a 

I. TMSI REALLOCATION COMPLETE during registration on CS from the UE, the USS sends RRC 
CONNECTION RELEASE to the UE, followed by RRC CONNECTION RELEASE COMPLETE 
sent by the UE to the USS. 

II. ATTACH COMPLETE during registration on PS from the UE, the USS sends RRC CONNECTION 
RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or. 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE during registration on CS/PS 
from the UE, the USS sends RRC CONNECTION RELEASE, followed by RRC CONNECTION 
RELEASE COMPLETE sent by the UE to the USS. 

e) The UE is soft powered down. 

7.3.2.5 Acceptance criteria 

1) After step a) the UE shall send an RRC CONNECTION REQUEST on the cell related to the BCCH transmitting 

MCC/MNC 244/010 to the USS. 

2) After step b) the UE shall send 

I. LOCATION UPDATING REQUEST to the USS during registration on CS or 

II. ATTACH REQUEST during registration on PS or 

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on 
CS/PS. 



3) After step c) the UE shall respond with 

I. TMSI REALLOCATION COMPLETE during registration on CS or 

II. ATTACH COMPLETE during registration on PS or 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE to the USS during registration 
on CS/PS. 

4) After step e) the USIM shall contain the following values: 
For UEs supporting (CS and PS) or (CS only): 

EF LO ci (Location Information) 

Logically: LAI-MCC: 244 

LAI-MNC: 010 
TMSI: "34567890" 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 




34 


56 


78 


90 


42 


04 


10 


XX 


XX 


XX 


00 



For UEs supporting (CS and PS) or (PS only): 

EFp SL oci (Location Information) 

Logically: RAI-MCC: 244 

RAI-MNC: 010 
P-TMSI: "34567890" 
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Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 

Hex 34 56 78 90 xx xx xx 42 04 10 xx 

Coding: B12 B13 B14 

Hex xx xx 00 



7.4 Higher priority PLMN search handling 

7.4.1 UE recognising the search period of the Higher priority PLMN 

7.4.1 .1 Definition and applicability 

The Higher priority PLMN list gives in priority order the Higher priority PLMN on which the UE shall register first. 
The Higher priority PLMN search period gives the time interval in which the UE shall search for a possible Higher 
priority PLMN registration. 

The registration attempts initiated by the UE depends on UEs capabilities and can be one of the following: 

I. registration procedures for UEs supporting CS or 

II. registration procedures for UEs supporting PS or 

III. registration procedures for UEs supporting CS/PS 

This test applies to Terminals accessing UTRAN. 

7.4.1.2 Conformance requirement 

After registered onto a VPLMN the UE shall take into account the Higher priority PLMN search period timer and the 
priority order of the Higher priority PLMNs in the preferred list on the USIM. 

• TS 22.01 1, subclauses 3.2.2 and 3.2.2.5. 

• TS 24.008, subclause 4.7.5 

7.4.1.3 Test purpose 

To verify that the Higher priority PLMN timer is read and the Higher priority PLMN takes precedence over the 
VPLMN in which the UE is currently registered in. 

7.4.1.4 Method of test 
7.4.1.4.1 Initial conditions 

For this test a UTRAN USS is needed. 

The USS transmits on BCCH, with the following network parameters: 
Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/082/0001. 

- RAI (MCC/MNC/LAC/RAC): 244/082/0001/05. 
Access control: unrestricted. 

After the registration of UE the USS transmits on a second BCCH, with the following network parameters: 
Attach/detach: disabled. 
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- LAI (MCC/MNC/LAC): 244/081/0001. 

- RAI (MCC/MNC/LAC/RAC): 244/081/0001/05. 
Access control: unrestricted. 

The default UICC shall be used with the following exception: 

EFhpplmn (Higher Priority PLMN Search period) 

Logically: set to 6minutes 

Coding: B1 
Hex 01 

The UICC shall be installed into the Terminal and the UE shall be set to automatic PLMN selection mode. 

7.4.1.4.2 Procedure 

a) The UE shall be powered on. 

b) After receipt of a RRC CONNECTION REQUEST from the UE, the USS shall send RRC CONNECTION 
SETUP to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

c) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. During registration on CS and after After receipt of a LOCATION UPDATEING REQUEST from the 
UE, the USS initiates authentication, starts integrity by using the security procedure and sends 
LOCATION UPDATEING ACCEPT with the following values to the UE: 

LAI (MCC/MNC/LAC): 244/082/0001 

TMSI: "34567890" 



II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS initiates 
authentication, starts integrity by using the security procedure and sends ATTACH ACCEPT with the 
following values to the UE: 

RAI (MCC/MNC/LAC/RAC) 244/082/0001/05 

P-TMSI "34567890" 

P-TMSI signature value "AB1234" 

III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or 
ATTACH REQUEST from the UE, the USS initiates authentication, starts integrity by using the 
security procedure and sends LOCATION UPDATING ACCEPT and/or ATTACH ACCEPT with 
some of the following values to the UE: 



LAI (MCC/MNC/LAC): 244/082/0001 
TMSI: "34567890" 

RAI (MCC/MNC/LAC/RAC) 244/082/0001/05 
P-TMSI "34567890" 

P-TMSI signature value "AB1234" 
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d) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. After receipt of a TMSI REALLOCATION COMPLETE from the UE during registration on CS, the 
USS sends RRC CONNECTION RELEASE to the UE, followed by RRC CONNECTION RELEASE 
COMPLETE sent by the UE to the USS or. 

II. After receipt of a ATTACH COMPLETE from the UE during registration on PS, the USS sends RRC 
CONNECTION RELEASE to the UE, followed by RRC CONNECTION RELEASE COMPLETE 
sent by the UE to the USS or. 

III. After receipt of a TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE from the UE 
during registration on CS/PS, the USS sends RRC CONNECTION RELEASE to the UE, followed by 
RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS. 

e) The USS starts to send on the second BCCH with the MCC/MNC 244/081. An internal timer shall start to run. 

f) After receipt on the cell related to the BCCH transmitting MCC/MNC 244/081 of a RRC CONNECTION 
REQUEST from the UE, the USS sends RRC CONNECTION SETUP to the UE, followed by RRC 
CONNECTION SETUP COMPLETE sent by the UE to the USS. The internal timer is stopped. 

g) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. During registration on CS and after receipt of a LOCATION UPDATING REQUEST from the UE, 
the USS initiates authentication, starts integrity by using the security procedure and sends 
LOCATION UPDATING ACCEPT with the following values to the UE: 

LAI (MCC/MNC/LAC): 244/081/0001 

TMSI: "12345678" 



II. During registration on PS and after receipt of a ROUTING AREA UPDATE REQUEST from the UE, 
the USS initiates authentication, starts integrity by using the security procedure and sends ROUTING 
AREA UPDATE ACCEPT with the following values to the UE: 

RAI (MCC/MNC/LAC/RAC) 244/081/0001/05 

P-TMSI "12345678" 

P-TMSI signature value "AB1234" 

III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or 
ROUTING AREA UPDATE REQUEST from the UE, the USS initiates authentication, starts 
integrity by using the security procedure and sends LOCATION UPDATING ACCEPT and/or 
ROUTING AREA UPDATE ACCEPT with some of the following values to the UE: 



LAI (MCC/MNC/LAC): 244/081/0001 
TMSI: "12345678" 

RAI (MCC/MNC/LAC/RAC) 244/081/0001/05 

P-TMSI "12345678" 

P-TMSI signature value "AB1234" 

h) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 
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I. After receipt of a TMSI REALLOCATION COMPLETE from the UE during registration on CS, the 
USS sends RRC CONNECTION RELEASE to the UE, followed by RRC CONNECTION RELEASE 
COMPLETE sent by the UE to the USS or. 

II. After receipt of a ROUTING AREA UPDATE COMPLETE from the UE during registration on PS, 
the USS sends RRC CONNECTION RELEASE to the UE, followed by RRC CONNECTION 
RELEASE COMPLETE sent by the UE to the USS or. 

III. After receipt of a TMSI REALLOCATION COMPLETE and/or ROUTING AREA UPDATE 
COMPLETE from the UE during registration on CS/PS, the USS sends RRC CONNECTION 
RELEASE to the UE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to 
the USS. 

i) The UE is soft powered down. 

7.4.1 .5 Acceptance criteria 

1) After step e) the UE shall send an RRC CONNECTION REQUEST on the cell related to the BCCH transmitting 

MCC/MNC 244/08 1 to the USS. 

2) After step e) the UE shall send 

I. LOCATION UPDATING REQUEST to the USS during registration on CS or. 

II. ROUTING AREA UPDATE REQUEST during registration on PS or 

III. LOCATION UPDATING REQUEST and/or ROUTING AREA UPDATE REQUEST to the USS 
during registration on CS/PS. 

3) After step g) the UE shall respond with 

I. TMSI REALLOCATION COMPLETE to the USS during registration on CS or 

II. ROUTING AREA UPDATE COMPLETE during registration on PS or 

III. TMSI REALLOCATION COMPLETE and/or ROUTING AREA UPDATE COMPLETE to the USS 
during registration on CS/PS. 

4) The value of the internal timer shall not exceed 6 minutes. 

NOTE: To take the systems processing time into account, the value of the internal timer may allowed to be a 
guard time of 10% greater than the required 6minutes. 

5) After step i) the USIM shall contain the following values: 
For UEs supporting (CS and PS) or (CS only): 

EF LO ci (Location Information) 

Logically: LAI-MCC: 244 

LAI-MNC: 081 
TMSI: "12345678" 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 


12 


34 


56 


78 


42 


14 


80 


XX 


XX 


XX 


00 



For UEs supporting (CS and PS) or (PS only): 

EFp SL oci (Location Information) 

Logically: RAI-MCC: 244 

RAI-MNC: 081 
P-TMSI: "12345678" 
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Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 

Hex 12 34 56 78 xx xx xx 42 14 80 xx 

Coding: B12 B13 B14 

Hex xx xx 00 



7.4.2 GSM/UMTS dual mode UEs recognising the search period of the 
Higher priority PLMN 

7.4.2.1 Definition and applicability 

The Higher priority PLMN list gives in priority order the Higher priority PLMN on which the UE shall register first. 
The Radio Access Technology identifier defines the Radio network in which the UE shall register. The list is stored on 
the USIM in the EF H plmnwact- The Higher priority PLMN search period gives the time interval in which the UE shall 
search for a possible Higher priority PLMN registration. This test applies to a GSM/UMTS dual mode UE that supports 
the Higher priority PLMN selector with Access Technology service. In the case that the terminal has implemented this 
feature according to Rel-6 or later, this test is optional. . 

To avoid a duplication of tests, this test supersede the previous test case (7.4.1). 

The registration attempts initiated by the UE depends on UEs capabilities and can be one of the following: 

I. registration procedures for UEs supporting CS or 

II. registration procedures for UEs supporting PS or 

III. registration procedures for UEs supporting CS/PS 



7.4.2.2 Conformance requirement 

After registered onto a VPLMN the UE shall take into account the Higher priority PLMN search period timer and the 
priority order of the Higher priority PLMNs in the preferred list on the USIM including the Access Technology 
Identifier. 

• TS 22.01 1, subclauses 3.2.2 and 3.2.2.5. 

7.4.2.3 Test purpose 

To verify that the Higher priority PLMN timer is read and the Higher priority PLMN with the higher priority (defined 
by its position in EF HPLMNwACT ) takes precedence over the VPLMN in which the UE is currently registered in. 

7.4.2.4 Method of test 
7.4.2.4.1 Initial conditions 

For this test both a GSM SS and a UTRAN USS is needed. 

The GSM SS transmits on BCCH, with the following network parameters: 

Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/082/0001. 

Access control: unrestricted. 

After the registration of UE the GSM SS transmits on a second BCCH, with the following network parameters: 

Attach/detach: disabled. 
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- LAI (MCC/MNC/LAC): 244/081/0001. 

Access control: unrestricted. 

At the same time as the SS sends on a second BCCH, the UMTS USS transmit on BCCH, with the following network 
parameters: 

Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/081/0001. 

- RAI (MCC/MNC/LAC/RAC): 244/081/0001/05. 
Access control: unrestricted. 

The default UICC is used with the following exceptions: 
EFhplmnwact (HPLMN selector with Access Technology) 

Logically: Set to MCC 244 and MNC 08 1 

Set to UTRAN 

Coding: B1 B2 B3 B4 B5 
Hex 42 14 80 80 00 

EFhpplmn (Higher Priority HPLMN Search period) 

Logically: set to 6minutes 

Coding: B1 
Hex 01 

EF UST (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 

Fixed dialling numbers available 

Barred dialling numbers available 

The GSM Access available 

The Group Identifier level 1 and level 2 not available 

Service n 33 (Packed Switched Domain) shall be set to T 

Enabled Services Table available 

HPLMN selector with access technology available 

Coding: B1 B2 B3 B4 B5 B6 

binary xx1 x xx1 1 xxxx xxxx xxxx 1 xOO xxxx x1 xx xxxx xx1 1 xxxx x1 xx 

The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

7.4.2.4.2 Procedure 

a) The UE is powered on. 

b) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the UE. 

c) After receipt of a LOCATION UPDATE REQUEST from the UE, the SS sends LOCATION UPDATE 
ACCEPT with: 

LAI (MCC/MNC): 244/082 

TMSI: "34567890" 
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to the UE. 

d) After receipt of a TMSI REALLOCATION COMPLETE from the UE, the SS sends CHANNEL RELEASE to 
the UE. 

e) The SS starts to send on the second BCCH with the MCC/MNC 244/081 and the USS starts to send with the 
Same MCC/MNC. An internal timer shall start to run. 

f) After receipt on the UTRAN-cell related to the BCCH transmitting MCC/MNC 244/081 of a RRC 
CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP to the UE, followed by 
RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. The internal timer is stopped. 

g) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. During registration on CS and after receipt of a LOCATION UPDATING REQUEST from the UE, 
the USS initiates authentication, starts integrity by using the security procedure and sends 
LOCATION UPDATING ACCEPT with the following values to the UE: 

LAI (MCC/MNC/LAC): 244/081/0001 

TMSI: "12345678" 



II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS initiates 
authentication, starts integrity by using the security procedure and sends ATTACH ACCEPT with the 
following values to the UE: 

RAI (MCC/MNC/LAC/RAC) 244/081/0001/05 

P-TMSI "12345678" 

P-TMSI signature value "AB1234" 

III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or 
ATTACH REQUEST from the UE, the USS initiates authentication, starts integrity by using the 
security procedure and sends LOCATION UPDATING ACCEPT and/or ATTACH ACCEPT with 
some of the following values to the UE: 



LAI (MCC/MNC/LAC): 244/081/0001 
TMSI: "12345678" 

RAI (MCC/MNC/LAC/RAC) 244/081/0001/05 
P-TMSI "12345678" 

P-TMSI signature value "AB1234" 



h) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. After receipt of a TMSI REALLOCATION COMPLETE from the UE during registration on CS, the 
USS sends RRC CONNECTION RELEASE to the UE, followed by RRC CONNECTION RELEASE 
COMPLETE sent by the UE to the USS or. 

II. After receipt of a ATTACH COMPLETE from the UE during registration on PS, the USS sends RRC 
CONNECTION RELEASE to the UE, followed by RRC CONNECTION RELEASE COMPLETE 
sent by the UE to the USS or. 
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III. After receipt of a TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE from the UE 
during registration on CS/PS, the USS sends RRC CONNECTION RELEASE to the UE, followed by 
RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS. 

i) The UE is soft powered down. 

7.4.2.5 Acceptance criteria 

1) After step e) the UE shall send an RRC CONNECTION REQUEST on the UTRAN-cell related to the BCCH 

transmitting MCC/MNC 244/081 to the USS. 

2) After step e) the UE shall send 

I. LOCATION UPDATING REQUEST to the USS during registration on CS, or 

II. ATTACH REQUEST during registration on PS or 

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on 
CS/PS. 

3) After step g) the UE shall respond with 

I. TMSI REALLOCATION COMPLETE to the USS during registration on CS, or 

II. ATTACH COMPLETE during registration on PS or 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE to the USS during registration 
on CS/PS. 

4) The value of the internal timer shall not exceed 6 minutes. 

NOTE: To take the systems processing time into account, the value of the internal timer may allowed to be a 
guard time of 10% greater than the required 6minutes. 

5) After step i) the USIM shall contain the following values: 



For UEs supporting (CS and PS) or (CS only): 
EF L oci (Location Information) 



Logically: 



Coding: 
Hex 



B1 
12 



LAI-MCC: 
LAI-MNC: 
TMSI: 



B2 
34 



B3 
56 



244 
081 
"12345678" 

B4 
78 



B5 
42 



B6 
14 



B7 
80 



B8 
xx 



B9 

XX 



B10 

XX 



B11 

00 



For UEs supporting (CS and PS) or (PS only): 
EF PSL0CI (Location Information) 



Logi 


ically: 


RAI-MCC: 244 
RAI-MNC: 081 




















P-TMSI: 


"12345678" 
















Coding: 


B1 


B2 


B3 B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 


12 


34 


56 78 


XX 


XX 


XX 


42 


14 


80 


XX 


Coding: 


B12 


B13 


B14 
















Hex 


XX 


XX 


00 
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7.5 Void 

8 Subscription independent tests 

8.1 Phone book procedures 

8.1 .1 Recognition of a previously changed phonebook 

8.1 .1 .1 Definition and applicability 

If the UICC is inserted into a GSM terminal, the phonebook my have been altered in this GSM session. If the ADN 
entry has been changed or deleted, the GSM terminal will not be able to change the appropriate additional phonebook 
entries (e.g. EF ANR Additional Number). In that case the UICC shall set a flag in the appropriate EF PBC (phonebook 
Control). If the UICC is inserted in a 3G Terminal later, the 3G Terminal shall recognise the flag and the phonebook 
shall be synchronised by the Terminal. Once the Terminal recognise the set flag in the EF PBC , the Terminal shall update 
the Change Counter in the EF C c- 

This test applies to all 3G Terminals. 

8.1 .1 .2 Conformance requirement 

The 3G Terminal shall recognise the set flag in the EF PB c and then synchronise the phonebook. The Terminal shall also 
update EF C c (Change Counter). 

• TS 31.121, subclause 4.4.2. 

8.1.1.3 Test purpose 

1) To verify that the 3G Terminal has recognised that the phonebook has been altered by a GSM Terminal. 

2) To verify that the 3G Terminal does the synchronising of the changed phonebook entries. 

3) To verify that the 3G Terminal updates the EF PBC and EF CC . 

8.1.1.4 Method of test 
8.1 .1 .4.1 Initial conditions 

No USS is needed for this test. 

The default UICC is used with the following exception: 

EF ADN (Abbreviated Dialling Number) 



Logically: 












Record 1: 


Length of alpha 
Alpha identifier: 


identifier: 


32 characters; 
"ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEF"; 






Length of BCD number: 


"03"; 








TON and NPI: 




Telephony and Unknown; 






Dialled number: 




123; 








CCI: 




None; 






Record 1: 
Coding: B1 


Extl: 




None. 






B2 B3 


B32 


B33 


B34 B35 B36 B37 B38 B39 ... 


B46 


Hex 41 


42 43 


46 


03 


81 21 F3 FF FF FF 


FF 
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EFp BC (Phonebook Control) 

Logically: 

Record 1: The ADN Record No. 1 has been hanged by a GSM terminal. 

Related ADN record is not hidden. 

Coding: B1 B2 
Hex 01 00 



EF CC (Change 


Counter) 


Logically: 


"000F" 


Coding: B1 


B2 


Hex 00 


OF 



The UICC is installed into the Terminal 

8.1.1.4.2 Procedure 

a) The 3G Terminal is powered on. 

b) The Terminal shall stay powered on until the phonebook synchronisation procedures are finished. If the 
synchronisation is indicated by the Terminal, the Terminal shall only powered down after this indication is 
vanished. 

8.1.1.5 Acceptance criteria 

After step b) the USIM shall contain the following values: 

EFpbc (Phonebook Control) 

Logically: 

Record 1 : The entry control information is reset. 

Related ADN record is not hidden. 

Coding: B1 B2 
Hex 00 00 

EF CC (Change Counter) 

Logically: The counter is incremented to "0010" 

Coding: B1 B2 
Hex 00 10 



8.1 .2 Update of the Phonebook Synchronisation Counter (PSC) 
8.1 .2.1 Definition and applicability 

The phonebook synchronisation Counter is used to unambiguously identify the status of the phonebook. Every time the 
phonebook is reset/deleted or the UID and/or the CC has run out of range, the PSC hall be regenerated. 

The PSC is a part of the phonebook identifier. 

This test applies to all 3G Terminals. 
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8.1.2.2 Conformance requirement 

Every time either the UID or the CC is incremented by the Terminal, the value of the contend of the appropriate EF 
shall be tested. If either UID or CC has reached "FF FF", the related EF shall be set to "00 01" and the PSC is 
incremented. 

• TS 31.102, subclause 4.4.2.12.2. 

8.1.2.3 Test purpose 

1) To verify that the 3G Terminal has recognised that the values of UID and CC has changed. 

2) To verify that the 3G Terminal resets the value of EFuid and EF C c- 

3) To verify that the 3G Terminal updates EF PS c- 

8.1.2.4 Method of test 
8.1.2.4.1 Initial conditions 

No USS is needed for this test. 

The default UICC is used with the following exception: 

EF UID (Unique Identifier) 

Logically: one record is set to "FF FF" 

Coding: B1 B2 
Hex FF FF 

EF PUID (Previous Unique Identifier) 

Logically: is set to "FF FF" 

Coding: B1 B2 
Hex FF FF 

EF CC (Change Counter) 

Logically: set to "FF FF" 

Coding: B1 B2 
Hex FF FF 

EFp S c (Phonebook Synchronisation Counter) 

Logically: set to "00 00 FF FF" 



Coding: 


B1 


B2 


B3 


B4 


Hex 


00 


00 


FF 


FF 



At least one phonebook entry shall be empty and available for creating a new entry (e.g. an appropriate ADN record). 
The UICC is installed into the Terminal and the UE is powered on and the correct PIN is entered. 

8.1.2.4.2 Procedure 

a) A new phonebook entry shall be created. 

NOTE 1 : This may be done by storing a new telephone number in an empty ADN record. 
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b) The UE shall have given the time to perform the regeneration of the UID records. 

NOTE 2: It is assumed that the UE will indicate the time it needs to perform the regeneration by displaying a busy 
signal to the use. 

8.1 .2.5 Acceptance criteria 

After step b) the USIM shall contain the following values: 

The EF UID (Unique Identifier) shall have been regenerated and the first value used to update EFuid shall have been "00 
01". The value FF FF shall have been replaced by an appropriate value which shall be distinguishable to the maximum 
value. EF PUID shall contain the UID value, which was used for the last update of EF UID 

EF C c (Change Counter) 

Logically: set to "00 01" 

Coding: B1 B2 
Hex 00 01 

EFps C (Phonebook Synchronisation Counter) 

Logically: set to "00 01 00 00" 



Coding: 


B1 


B2 


B3 


B4 


Hex 


00 


01 


00 


00 



8.2 Short message handling report 

8.2.1 Correct storage of a SM on the USIM 

8.2.1 .1 Definition and applicability 

Once a SM is received by the UE, the Terminal shall store the SM on the USIM, if this is indicated by the class 2 of the 
SMS (USIM specific SM). For this it is assumed, that at least one relevant SMS field are available on the USIM and 
they are indicated as empty. If all SMS data field are full and furthermore all memory capacity reserved for SMS inside 
the ME is filled up to maximum and a SM was rejected, then this shall be indicated in the SMS Status file. 

This test applies to all 3G Terminal accessing UTRAN and supporting "receive SMS" functionality. 

8.2.1.2 Conformance requirement 

The received class 2 SMS shall be stored on the USIM in EF S ms- The status of a received SMS, which has not been read 
yet, shall be set to "3" (SMS to be read). If the terminal notifies the network that the terminal has been unable to accept 
a short message because its memory capacity has been exceeded, then the ME shall set the Memory Capacity Exceeded 
Notification Flag in the EF SMSS . 

• TS 23.038, clause 4. 

• TS 23 .040, subclause 10.1, Operation 6 

• TS 24.01 1, subclause 8.2.2, 8.2.3 and 8.2.5.4, Table 8.4 (part 2) 

• TS 31.102, subclauses 4.2.25 and 4.2.28. 

8.2.1.3 Test purpose 

1) To verify that the 3G Terminal stored correctly the class 2 SMS on the USIM. 

2) To verify that the 3G Terminal sets the status of a received, and not yet read SMS to "3" (SMS to be read). 
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3) To verify that the 3G Terminal sets the memory full flag in EF SMSS . if the terminal notifies the network that the 
terminal has been unable to accept a short message because its memory capacity has been exceeded 

8.2.1.4 Method of test 

8.2.1.4.1 Initial conditions 

The default UICC is used with the following exception: 

EF UST (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 

Fixed dialling numbers available 

Barred dialling numbers available 

The GSM Access available 

The Group Identifier level 1 and level 2 not available 

SMS available 

SMS Status available 

Service n 33 (Packed Switched Domain) shall be set to T 

Enabled Services Table available 

Coding: B1 B2 B3 B4 B5 

binary xx1 x xx1 1 xxxx x1 1 x xxxx 1 xOO xxxx x1 xx xxxx xx1 1 

The coding of EF UST shall conform with the capabilities of the USIM used. 
EFsms (Short Message Service) 

At least 10 records. 

Record 1 shall be empty. 

Logically: Status byte set to empty. 

Record 1: 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 B12 ... B176 

Hex 00 FF FF FF FF FF FF FF FF FF FF FF ... FF 

All other Record shall be full. 

Logically: Status byte set to SMS read. 

The text body of the record shall be filled with any appropriate text. 

Records: 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 B12 ... B176 

Hex 01 xx xx xx xx xx xx xx xx xx xx xx ... xx 

NOTE: "xx" shall be the appropriate text using the SMS default 7-bit coded alphabet as defined in 3G TS 23.038 
which represents the received SMS. 

EF S mss (SMS Status) 

Logically: Last used TP-MR not defined. 

Memory capacity available (flag unset bl="l"). 

Coding: B1 B2 

Hex FF FF 

The USS transmits on the BCCH, with the following network parameters: 
- Attach/detach: disabled. 
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- LAI (MCC/MNC/LAC): 246/081/0001. 
Access control: unrestricted. 

The USS transmits the short messages with the following parameters: 
Logically: 
Class 2 SM: 

TS-Service Centre Address: 

Bit 8: 1 

Type-Of-N umber: 



International number 



Numbering-Plan-Identification: ISDN/telephony numbering plan 
Address value: 112233445566 

SMS TPDU: 

TP-Message-Type-Indicator: SMS -DELIVER (in the direction SC to MS) 

TP-More-Messages-to-Send: No more messages are waiting for the MS in this SC 

TP-Reply-Path: TP-Reply-Path parameter is not set in this SMS -DELIVER 

TP-User-Data-Header-Indicator: The TP-UD field contains only the short message 
TP-Status-Report-Indication: A status report shall be returned to the SME 

Bits 4-3: 00 

TP-Originating-Address: 

1 

International number 

ISDN/telephony numbering plan 

012344556677 
No interworking, but SME-to-SME protocol 



Bit 8: 

Type-Of-Number: 

Numbering-Plan-Identification: 

Address value: 
TP-Protocol-Identifier: 
TP-Data-Coding-Scheme: 

Bits 8-7: 

Bit 6: 

Bit 5: 

Bits 4-3: 

Bits 2-1: 



General Data Coding 

Text is uncompressed 

Bits 2-1 have a message class meaning 

GSM 7 bit default alphabet 

Class 2: (U)SIM specific message 



TP-Service-Centre-Time-Stamp: 02-03-04 09:13:06 GMT + 1 

TP-User-Data-Length: 160 

TP-User-Data: 

"Once a SMS is received by the UE, the Terminal shall store the SMS on the USIM, if this is indicated by the 
class 2 of the SMS (USIM specific SMS). For this..." 



Class 1 SM: 
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The same content as for the Class 2 SM except: 
SMS TPDU: 

TP-More-Messages-to-Send: 
TP-Data-Coding-Scheme: 
Bits 2-1: 
TP-Service-Centre-Time-Stamp: 



More messages are waiting for the MS in this SC 

Class 1 : default meaning: ME-specific 
Always set to current time of the system simulatorUser Equipment: 



The UE is in MM-state "idle, updated". If there is ME storage capacity available, the storage for SMS inside the 
ME shall be able to allow for at least one more mobile terminated (e.g. Class 1) SM. 



8.2.1.4.2 



Procedure 



a) After the UE is set to idle mode, the defined Class 2 SM defined in 8.2.1.4.1 with 160 characters shall be sent to 
the UE. 

b) After the UE has indicated that a SM was received, the SM shall not be read. 

c) The USS starts sending Class 1 SMs as defined in 8.2.1.4.1 until the UE sends an RP-ERROR message with 
cause 'Memory capacity exceeded'. 

d) The UE is powered off. 

8.2.1 .5 Acceptance criteria 

1) After step b) the record of the EF S ms which was empty, shall contain the following values: 
Record 1: 
Logically: 
Status: 

RFU bits 8-6: 
Status: 
TS-Service Centre Address: 
Bit 8: 
Type-Of-N umber: 



000 

Used space, message received by MS from network, message to be read 



International number 



Numbering-Plan-Identification: ISDN/telephony numbering plan 

Address value: 112233445566 
SMS TPDU: 

TP-Message-Type-Indicator: SMS -DELIVER (in the direction SC to MS) 

TP-More-Messages-to-Send: No more messages are waiting for the MS in this SC 

TP -Reply-Path: TP-Reply-Path parameter is not set in this SMS -DELIVER 

TP-User-Data-Header-Indicator: The TP-UD field contains only the short message 

TP-Status-Report-Indication: A status report shall be returned to the SME 

Bits 4-3: 00 

TP-Originating-Address: 
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Bit 8: 1 

Type-Of-Number: International number 

Numbering-Plan-Identification: ISDN/telephony numbering plan 

Address value: 012344556677 

TP-Protocol-Identifier: No interworking, but SME-to-SME protocol 
TP-Data-Coding-Scheme: 

Bits 8-7: General Data Coding 

Bit 6: Text is uncompressed 

Bit 5: Bits 2-1 have a message class meaning 

Bits 4-3: GSM 7 bit default alphabet 

Bits 2-1: Class 2: (U)SIM specific message 

TP-Service-Centre-Time-Stamp: 02-03-04 09:13:06 GMT + 1 

TP-User-Data-Length: 160 

TP-User-Data: 

"Once a SMS is received by the UE, the Terminal shall store the SMS on the USIM, if this is indicated by the 
class 2 of the SMS (USIM specific SMS). For this ..." 



Coding: 


































Hex 


03 


07 


91 


11 


22 


33 


44 


55 


66 


24 


OC 


91 


10 


32 


44 


55 




66 


77 


00 


12 


20 


30 


40 


90 


31 


60 


40 


A0 


4F 


F7 


B8 


OC 




0A 


83 


A6 


CD 


29 


28 


3D 


07 


C9 


CB 


E3 


72 


DA 


5E 


26 


83 




C4 


79 


10 


1D 


5D 


06 


55 


8B 


2C 


10 


1D 


5D 


06 


51 


CB 


F2 




76 


DA 


1D 


66 


83 


E6 


E8 


30 


9B 


0D 


9A 


D3 


DF 


F2 


32 


88 




8E 


2E 


83 


A6 


CD 


29 


E8 


ED 


06 


D1 


D1 


65 


50 


75 


9A 


6C 




B2 


40 


69 


33 


88 


8E 


4E 


CF 


41 


E9 


39 


28 


ED 


26 


A7 


C7 




61 


7A 


99 


OC 


12 


E7 


41 


74 


74 


19 


34 


66 


87 


E7 


73 


90 




OC 


F4 


36 


83 


E8 


E8 


32 


68 


DA 


9C 


82 


50 


D5 


69 


B2 


09 




9A 


C3 


CB 


E3 


B4 


39 


3D 


06 


4D 


9B 


D3 


94 


0B 


64 


7C 


CB 




41 


74 


74 


7A 


0E 


72 


B9 


5C 



















2) After step d) the Memory Capacity Exceeded Notification Flag in the EF SMSS shall be set to exceeded. 
EF S mss (SMS Status) 

Logically: Last used TP-MR shall be set to any appropriate value. 

Memory capacity exceeded (flag set bl="0"). 

Coding: B1 B2 

Hex xx FE 



8.2.2 Correct reading of a SM on the USIM 
8.2.2.1 Definition and applicability 

A SM which is stored but not yet read, is indicated as Status "3" (SMS to be read ) on EF S ms- The Terminal may 
indicate the user this status. After the SMS is read by the user, the status of the SMS shall be changed to "1" (SMS 
read). 

This test applies to all 3G Terminal accessing UTRAN and supporting "receive SMS" functionality. 
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8.2.2.2 Conformance requirement 

A received SM was stored on the USIM in EF SMS . At the time the SMS is read by the user, the status of a received 
SMS, shall be changed to "1" (SMS read). 

• TS 23.038, clause 4. 

• TS 23.040; 

• TS 31.102, subclauses 4.2.25 and 4.2.28. 

8.2.2.3 Test purpose 

1) To verify that the 3G Terminal read correctly the SMS on the USIM. 

2) To verify that the 3G Terminal changes the status of a read SMS to "1" (SMS read). 

8.2.2.4 Method of test 
8.2.2.4.1 Initial conditions 

The default UICC is used with the following exception: 

EF UST (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 

Fixed dialling numbers available 

Barred dialling numbers available 

The GSM Access available 

The Group Identifier level 1 and level 2 not available 

SMS available 

SMS Status available 

Service n 33 (Packed Switched Domain) shall be set to '1' 

Enabled Services Table available 

Coding: B1 B2 B3 B4 B5 

binary xx1 x xx1 1 xxxx x1 1 x xxxx 1 xOO xxxx x1 xx xxxx xx1 1 

The coding of EF UST shall conform with the capabilities of the USIM used. 
EF S mss (SMS Status) 

Logically: Last used TP-MR not set. 

Memory capacity available (flag unset bl=" 1"). 

Coding: B1 B2 

Hex FF FF 

EF SMS (Short Message Service) 

Logically: Status byte set to SMS to be read. 

A chosen test is written in the text body of the EF SMS . 

Record 1: 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 B12 ... B176 

Hex 03 xx xx xx xx xx xx xx xx xx xx xx ... xx 

NOTE: "xx" shall be the appropriate text using the SMS default 7-bit coded alphabet as defined in 
3GPP TS 23.038 which represents the stored SMS. 
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At least 9 records. 

Logically: Status byte set to empty 

No text is written (Remainder Bytes set to "FF"). 

Record: 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 B12 ... B176 

Hex 00 FF FF FF FF FF FF FF FF FF FF FF ... FF 

A USS is only needed to bring the UE into a defined idle mode. The USS transmits on the BCCH: 

Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

Access control: unrestricted. 

User Equipment: 

The UE is in MM-state "idle, updated". 

8.2.2.4.2 Procedure 

a) After the UE has brought in idle state, the SMS shall be read. 

b) The UE is powered off. 

8.2.2.5 Acceptance criteria 

1) After a) the correct text of the SM shall be read from the UE display. 

2) After step b) the EF S ms record 1 shall contains the following values: 

Logically: Status byte set to SMS read. 

The entire content of the SM shall be unchanged. 



Record 1: 
Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 ... 


B176 


Hex 


01 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 



NOTE: "xx" shall be the appropriate text using the SMS default 7-bit coded alphabet as defined in TS 23.038 
which represents the stored SMS. 

8.3 MMS related tests 

8.3.1 UE recognising the priority order of MMS Issuer Connectivity 
Parameters 

8.3.1 .1 Definition and applicability 

An MMS User Agent should use the MMS related information stored in the USIM, if present, unless otherwise 
specified by the user. Some of these sets of MMS connectivity parameters are preset by the issuer of the USIM with the 
first supported set being the default. Such preset MMS connectivity parameters set should be selected unless otherwise 
specified by the user. 

The MMS connectivity information on the USIM includes preferences for the selection of Interface to Core Network 
and Bearer parameters. If these are stored on the USIM the MMS-capable UE should automatically select the Interface 
to Core Network and Bearer parameters based on their order of precedence defined on the USIM unless otherwise 
specified by the user. 
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MMS user preferences information, which is stored on the USIM, should be used by an MMS User Agent for user 
assistance in preparation of terminal-originated MMs (e.g. default values for parameters that are often used). 

This test applies to Terminals accessing UTRAN, supporting MMS and supporting the usage of MMS related data 
stored on the USIM and when no user MMS connectivity parameters have been selected. 

8.3.1.2 Conformance requirement 

The MMS User Agent of a terminal, which supports the usage of MMS related data stored on the USIM, shall use the 
MMS connectivity parameters stored first in the supported parameter sets of EF MMSICP as default parameters to 
connect to the network for MMS purposes (i.e. sending an User generated MM). 

• TS 31.102 [4], subclauses 4.2.69 and 5.3.30; 

• TS 23 . 1 40 [23 ] , subclause 6 . 1 . 1 1 and Annex F. 

MMS user preferences information, which is stored on the USIM, shall be used by an MMS User Agent of a terminal, 
which supports the usage of MMS related data stored on the USIM, for user assistance in preparation of terminal- 
originated MMs. 

• TS 31.102 [4], subclauses 4.2.70 and 5.3.31; 

• TS 23.140 [23], subclause 6.1.11 and Annex F. 

8.3.1.3 Test purpose 

1) To verify that the Terminal's MMS User Agent uses the MMS connectivity parameter stored on the USIM to 
connect to the network for MMS purposes. 

2) To verify that the Terminal's MMS User Agent uses the first stored set of supported parameters in EF MMSICP 
as default. 

3) To verify that the Terminal's MMS User Agent uses the MMS user preference information stored on the USIM 
for user assistance in preparation of terminal-originated MMs. 

8.3.1.4 Method of test 
8.3.1.4.1 Initial conditions 

Four MMS Relays/Servers are available: 
MMS Relay/Server 1: 
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MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay /Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 

Authentication id: 

Authentication pw: 
Gateway 

Address: 

Type of address: 

Port : 

Service: 

Authentication type: 

Authentication id: 

Authentication pw: 



"WAP" 

"http:// mms -operator 1 .com " 

"GSM-CSD" 

"+496998625" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"B2B_OTSl" 

"B2B_passwordl" 

"170.187.51.3" 

"IPv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_userl" 

"gateway_passwordl " 



MMS Relay/Server 2: 

- MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay /Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 

Authentication id: 

Authentication pw: 
Gateway 

Address: 

Type of address: 

Port: 

Service: 

Authentication type: 

Authentication id: 

Authentication pw: 



"WAP" 

"http:// mms-operatorl .com " 

"GSM-CSD" 

"+496998626" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"B2C_OTS2" 

"B2C_password2" 

"170.187.51.3" 

"IPv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_userl" 

"gateway_passwordl " 



MMS Relay/Server 3: 
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MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay /Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Call type: 

Delivery of erroneous SDU: 

Residual Bit Error Rate: 

SDU-Error-Ratio: 

Traffic-class: 

Maximum bit rate for downlink: 

Authentication type: 

Authentication id: 

Authentication pw: 
Gateway 

Address: 

Type of address: 

Port : 

Service: 

Authentication type: 

Authentication id: 

Authentication pw: 



"WAP" 

"http:// mms -operator 1 .com " 

"GSM-GPRS" 

"wap.B2B-operatorl.com" 

"APN" 

"ANALOG_MODEM" 

"No" 

"1*10" 5 " 

"1*10 6 " 

"Interactive class" 

"8 kbps" 

"PAP" 

"B2B_OTSl" 

"B2B_passwordl" 

"170.187.51.3" 

"IPv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_userl" 

"gateway_passwordl " 



MMS Relay/Server 4: 

- MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay /Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Call type: 

Delivery of erroneous SDU: 

Residual Bit Error Rate: 

SDU-Error-Ratio: 

Traffic-class: 

Maximum bit rate for downlink: 

Authentication type: 

Authentication id: 

Authentication pw: 
Gateway 

Address: 

Type of address: 

Port : 

Service: 

Authentication type: 

Authentication id: 

Authentication pw: 



"WAP" 

"http:// mms-operatorl .com " 

"GSM-GPRS" 

" wap.B2C-operatorl .com" 

"APN" 
"ANALOG_MODEM" 

"No" 

"mo -5 " 
"mo -6 " 

"Interactive class" 
"8 kbps" 
"PAP" 

"B2C_OTS2" 
"B2C_password2" 

"170.187.51.3" 

"IPv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_userl" 

"gateway_passwordl " 



The default UICC is used with the following exceptions: 
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EF UST (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 

Fixed dialling numbers available 

Barred dialling numbers available 

The GSM Access available 

The Group Identifier level 1 and level 2 not available 

SMS available 

SMS Status available 

Service no. 33 (Packed Switched Domain) shall be set to T 

Service no. 52 Multimedia Messaging Service available 

Service no. 55 MMS User Connectivity Parameters not available 



Coding: B1 B2 B3 B4 


B5 


B6 


B7 


Binary xx1xxx11 x11xxxxx xxxx1x00 xxxxxlxx 


XXXX XXX 1 


XXXX XXXX 


xOxx 1 XXX 


EF MMSN 








Logically: 








MMS Status: Free space 








MMS Implementation : "00" 








MMS Notification: "FF FF . . . FF" (25 1 bytes) 








Extension file record number: "FF" 









Coding: B1 B2 B3 B4 B5 ... B254 B255 

00 00 00 FF FF FF FF 



EF MMSICP 
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Logically: 




MMS Connectivity Parameters 




MMS Implementation 




MMS Implementation Information : 


"WAP" 


MMS Relay/Server 




MMS Relay/Server Address 


"http://mms-operatorl .com' 


1 st Interface to Core Network and Bearer 




Bearer: 


"GSM-CSD" 


Address: 


"+496998625" 


Type of address: 


"E164" 


Speed: 


"Autobauding" 


Call type: 


"ANALOG_MODEM" 


Authentication type: 


"PAP" 


Authentication id: 


"B2B_OTSl" 


Authentication pw: 


"B2B_passwordl" 


2 nd Interface to Core Network and Bearer 




Bearer: 


"GSM-CSD" 


Address: 


"+496998626" 


Type of address: 


"E164" 


Speed: 


"Autobauding" 


Call type: 


"ANALOG_MODEM" 


Authentication type: 


"PAP" 


Authentication id: 


"B2C_OTS2" 


Authentication pw: 


"B2C_password2" 


3 ld Interface to Core Network and Bearer 




Bearer: 


"GSM-GPRS" 


Address: 


" wap.B2B-operatorl .com" 


Type of address: 


"APN" 


Call type: 


"ANALOG_MODEM" 


Delivery of erroneous SDU: 


"No" 


Residual Bit Error Rate: 


"mo" 5 " 


SDU-Error-Ratio: 


"1*10 6 " 


Traffic-class: 


"Interactive class" 


Maximum bit rate for downlink: 


"8 kbps" 


Authentication type: 


"PAP" 


Authentication id: 


"B2B_OTSl" 


Authentication pw: 


"B2B_passwordl" 


4 th Interface to Core Network and Bearer 




Bearer: 


"GSM-GPRS" 


Address: 


"wap.B2C-operatorl .com" 


Type of address: 


"APN" 


Call type: 


"ANALOG_MODEM" 


Delivery of erroneous SDU: 


"No" 


Residual Bit Error Rate: 


"1*10" 5 " 


SDU-Error-Ratio: 


"1*10 6 " 


Traffic-class: 


"Interactive class" 


Maximum bit rate for downlink: 


"8 kbps" 


Authentication type: 


"PAP" 


Authentication id: 


"B2C_OTS2" 


Authentication pw: 


"B2C_password2" 


Gateway: 




Address: 


"170.187.51.3" 


Type of address: 


"IPv4" 


Port : 


"9201" 


Service: 


"CO-WSP" 


Authentication type: 


"HTTP BASIC" 


Authentication id: 


"gateway_userl" 


Authentication pw: 


"gateway_passwordl " 
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Coding: AB 


82 


01 


47 


80 


01 


01 


81 


18 


68 


74 


74 


70 


3A 


2F 


2F 


6D 


6D 


73 


2E 


6F 


70 


65 


72 


61 


74 


6F 


72 


31 


2E 


63 


6F 


6D 


82 
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10 


AA 


08 


2B 


34 


39 


36 


39 


39 


38 


36 


32 


35 


00 


09 


87 


25 


C5 


OA 


90 


OC 


9A 


OD 


42 


32 


42 


11 


4F 


54 


53 


31 


00 


OE 


42 


32 


42 


11 


70 


61 


73 


73 


77 


6F 


72 


64 


31 


00 


82 


2F 
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AA 


08 
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C5 
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4F 


54 


53 


32 


00 


OE 


42 


32 


43 


11 


70 


61 


73 


73 


77 


6F 


72 


64 


32 


00 


82 


43 


10 


AB 


08 


03 
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61 


70 


OD 


42 


32 


42 


2D 


6F 


70 


65 


72 


61 


74 


6F 


72 


31 


03 


63 


6F 


6D 


00 


09 


89 


OA 


90 


31 


03 


37 


70 


38 
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33 


60 


36 


08 


OC 


9A 


OD 


42 


32 


42 


11 


4F 


54 
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72 
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82 
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09 


89 
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90 


31 
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37 


70 


38 
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33 
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OC 


9A 


OD 
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32 


43 


11 


4F 


54 


53 


32 


00 


0E 


42 


32 


43 


11 


70 


61 


73 


73 


77 


6F 


72 


64 


32 


00 


83 


43 


20 


31 


37 


30 


2E 


31 


38 


37 


2E 


35 


31 


2E 


33 


00 


21 


85 


23 


39 


32 


30 


31 


00 


24 


CB 


19 


9C 


1A 


67 


61 


74 


65 


77 


61 


79 


11 


75 


73 


65 


72 


31 


00 


1B 


67 


61 


74 


65 


77 


61 


79 


11 


70 


61 


73 


73 


77 


6F 


72 


64 


31 


00 












EF MMSUP 

























Logically: 

MMS Implementation 

MMS implementation information: "WAP" 

MMS User Preference Profile Name: "Greeting cards" 
MMS User Information Preference Information 

Visibility: "hide" 

Delivery report: "yes" 

Read-reply: "yes" 

Priority: "normal" 

Delivery-Time: 

Value (absolute): " l-Jan-2003, 12:00:00 AM GMT" 

Expiry: 

Value (relative): 1 104537600 seconds 



Coding: 


80 


01 


01 


81 


0E 


47 


72 


65 


65 


74 


69 


6E 




67 


20 


63 


61 


72 


64 


73 


82 


19 


14 


80 


06 




80 


10 


80 


OF 


81 


07 


07 


80 


05 


00 


3E 


12 




2F 


80 


08 


06 


81 


04 


41 


D5 


E8 


00 







The UICC is installed into the Terminal and the user has indicated the data stored in EF MMSICP as default. 

8.3.1.4.2 Procedure 

a) The Terminal is powered on and the PIN shall be entered. 

b) When the Terminal is in idle mode the user shall generate an MM using the MMS User Agent on the Terminal 
with the default MMS connectivity settings provided by the card issuer and the MMS user preference 
information stored in the card and send it to "+0123456789". 



ETSI 



3GPP TS 31.121 version 4.13.0 Release 4 123 ETSI TS 131 121 V4.13.0 (2005-10) 

8.3.1 .5 Acceptance criteria 

1) After step b) the Terminal shall have read the set of supported MMS connectivity parameters stored first in EF 
MMSICP. 

2) After step b) the Terminal shall have sent the MM to "+0123456789" using the MMS connectivity parameters 
stored first in the supported parameter sets in EF MMSICP. 

3) After step b) the Terminal shall have sent the MM to "+0123456789" using the MMS user preference 
information stored in EF MMSUP. 

8.3.2 UE recognising the priority order of MMS User Connectivity 
Parameters 

8.3.2.1 Definition and applicability 

An MMS User Agent should use the MMS related information stored in the USIM, if present, unless otherwise 
specified by the user. The MMS connectivity parameters determined by the user, with the first supported set being the 
default, should be used to connect to the network for purpose of accessing the MMS Relay/Server. 

The MMS connectivity information on the USIM includes preferences for the selection of Interface to Core Network 
and Bearer parameters. If these are stored on the USIM the MMS-capable UE should automatically select the Interface 
to Core Network and Bearer parameters based on their order of precedence defined on the USIM unless otherwise 
specified by the user. 

MMS user preferences information, which is stored on the USIM, should be used by an MMS User Agent for user 
assistance in preparation of terminal-originated MMs (e.g. default values for parameters that are often used). 

This test applies to Terminals accessing UTRAN, supporting MMS and supporting the usage of MMS related data 
stored on the USIM and when no user MMS connectivity parameters have been selected. 

8.3.2.2 Conformance requirement 

When using the MMS User Connectivity Parameters to connect to the network for MMS purposes (i.e. sending an User 
generated MM), the MMS User Agent of a terminal, which supports the usage of MMS related data stored on the 
USIM, shall use the MMS User Connectivity Parameters with the highest priority (as defined by its position in EF 
MMSUCP) unless otherwise specified by the user. 

• TS 31.102 [4], subclauses 4.2.71 and 5.3.32; 

• TS 23.140 [23], subclause 6.1.11 and Annex F. 

MMS user preferences information, which is stored on the USIM, shall be used by an MMS User Agent of a terminal, 
which supports the usage of MMS related data stored on the USIM, for user assistance in preparation of terminal- 
originated MMs. 

• TS 31.102 [4], subclauses 4.2.70 and 5.3.31; 

• TS23.140[23], subclause 6 . 1 . 1 1 and Annex F. 

8.3.2.3 Test purpose 

1) To verify that the Terminal's MMS User Agent uses the MMS connectivity parameter stored on the USIM to 
connect to the network for MMS purposes. 

2) To verify that when using the MMS User Connectivity Parameters to connect to the network for MMS purposes 
the Terminal's MMS User Agent uses the set of supported parameters in EF MMSUCP with the highest priority 
(as defined by its position in EF MMSUCP). 

3) To verify that the Terminal's MMS User Agent uses the MMS user preference information stored on the USIM 
for user assistance in preparation of terminal-originated MMs. 
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8.3.2.4 



Method of test 



8.3.2.4.1 



Initial conditions 



Four MMS Relays/Servers are available: 
MMS Relay/Server 1: 

- MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay /Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 

Authentication id: 

Authentication pw: 
Gateway 

Address: 

Type of address: 

Port: 

Service: 

Authentication type: 

Authentication id: 

Authentication pw: 



"WAP" 

"http:// mms-operator2.com " 

"GSM-CSD" 

"4495251699" 

"El 64" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"UDO_OTSl" 

"Udo_passwordl " 

"170.187.51.4" 

"IPv4" 

"9203" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user7" 

"gateway_password7" 



MMS Relay/Server 2: 

- MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay /Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 

Authentication id: 

Authentication pw: 
Gateway 

Address: 

Type of address: 

Port : 

Service: 

Authentication type: 

Authentication id: 

Authentication pw: 



"WAP" 
"http:// mms-operator2.com " 

"GSM-CSD" 

"+49525 1700" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"UDO_OTS2" 

"Udo_password2" 

"170.187.51.4" 

"IPv4" 

"9203" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user7" 

"gateway_password7" 



MMS Relay/Server 3: 
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MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay /Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Call type: 

Delivery of erroneous SDU: 

Residual Bit Error Rate: 

SDU-Error-Ratio: 

Traffic-class: 

Maximum bit rate for downlink: 

Authentication type: 

Authentication id: 

Authentication pw: 
Gateway 

Address: 

Type of address: 

Port : 

Service: 

Authentication type: 

Authentication id: 

Authentication pw: 



"WAP" 

"http:// mms-operator2.com " 

"GSM-GPRS" 

"wap.B2B-operator2.com" 

"APN" 

"ANALOG_MODEM" 

"No" 

"1*10" 5 " 

"1*10 6 " 

"Interactive class" 

"8 kbps" 

"PAP" 

"UDO_OTSl" 

"Udo_passwordl " 

"170.187.51.4" 

"IPv4" 

"9203" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user7" 

"gateway_password7" 



MMS Relay/Server 4: 

- MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay /Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Call type: 

Delivery of erroneous SDU: 

Residual Bit Error Rate: 

SDU-Error-Ratio: 

Traffic-class: 

Maximum bit rate for downlink: 

Authentication type: 

Authentication id: 

Authentication pw: 
Gateway 

Address: 

Type of address: 

Port : 

Service: 

Authentication type: 

Authentication id: 

Authentication pw: 



"WAP" 
"http:// mms-operator2.com " 

"GSM-GPRS" 

"wap.B2C-operator2.com" 

"APN" 
"ANALOG_MODEM" 

"No" 

"mo -5 " 
"mo -6 " 

"Interactive class" 
"8 kbps" 
"PAP" 

"UDO_OTS2" 
"Udo_password2" 

"170.187.51.4" 

"IPv4" 

"9203" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user7" 

"gateway_password7" 



The default UICC is used with the following exceptions: 
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EF UST (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 

Fixed dialling numbers available 

Barred dialling numbers available 

The GSM Access available 

The Group Identifier level 1 and level 2 not available 

SMS available 

SMS Status available 

Service no. 33 (Packed Switched Domain) shall be set to T 

Service no. 52 Multimedia Messaging Service available 

Service no. 55 MMS User Connectivity Parameters available 



Coding: B1 B2 B3 B4 


B5 


B6 


B7 


Binary xx1xxx11 x11xxxxx xxxxIxOO xxxxxlxx 


XXXX XXX 1 


XXXX XXXX 


x1 XX 1 XXX 


EF MMSN 








Logically: 








MMS Status: Free space 








MMS Implementation : "00" 








MMS Notification: "FF FF . . . FF" (25 1 bytes) 








Extension file record number: "FF" 









Coding: B1 
00 



B2 
00 



B3 
00 



B4 
FF 



B5 
FF 



B254 
FF 



B255 
FF 



EF MMSICP 
Logically: 



Empty 



Coding: B1 
FF 



B2 
FF 



Bxx 
FF 



EF MMSUP 



Logically: 



MMS Implementation 

MMS implementation information: "WAP" 

MMS User Preference Profile Name: "Greeting cards" 
MMS User Information Preference Information 

Visibility: "hide" 

Delivery report: "yes" 

Read-reply: "yes" 

Priority: "normal" 

Delivery-Time: 

Value (absolute): " l-Jan-2003, 12:00:00 AM GMT" 

Expiry: 

Value (relative): 1 104537600 seconds 



Coding: 
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EF MMSUCP 



Logically: 




MMS Connectivity Parameters 




MMS Implementation 




MMS Implementation Information : 


"WAP" 


MMS Relay/Server 




MMS Relay/Server Address 


"http://mms-operator2.com' 


1 st Interface to Core Network and Bearer 




Bearer: 


"GSM-CSD" 


Address: 


"+49525 1699" 


Type of address: 


"E164" 


Speed: 


"Autobauding" 


Call type: 


"ANALOG_MODEM" 


Authentication type: 


"PAP" 


Authentication id: 


"UDO_OTSl" 


Authentication pw: 


" Udo_password 1 " 


2 nd Interface to Core Network and Bearer 




Bearer: 


"GSM-CSD" 


Address: 


"+49525 1700" 


Type of address: 


"E164" 


Speed: 


"Autobauding" 


Call type: 


"ANALOG_MODEM" 


Authentication type: 


"PAP" 


Authentication id: 


"UDO_OTS2" 


Authentication pw: 


" Udo_pass word2 " 


3 ld Interface to Core Network and Bearer 




Bearer: 


"GSM-GPRS" 


Address: 


"wap.B2B-operator2.com" 


Type of address: 


"APN" 


Call type: 


"ANALOG_MODEM" 


Delivery of erroneous SDU: 


"No" 


Residual Bit Error Rate: 


"1*10~ 5 " 


SDU-Error-Ratio: 


"1*10 6 " 


Traffic-class: 


"Interactive class" 


Maximum bit rate for downlink: 


"8 kbps" 


Authentication type: 


"PAP" 


Authentication id: 


"UDO_OTSl" 


Authentication pw: 


" Udo_password 1 " 


4 th Interface to Core Network and Bearer 




Bearer: 


"GSM-GPRS" 


Address: 


"wap.B2C-operator2.com" 


Type of address: 


"APN" 


Call type: 


"ANALOG_MODEM" 


Delivery of erroneous SDU: 


"No" 


Residual Bit Error Rate: 


"1*10" 5 " 


SDU-Error-Ratio: 


"1*10" 6 " 


Traffic-class: 


"Interactive class" 


Maximum bit rate for downlink: 


"8 kbps" 


Authentication type: 


"PAP" 


Authentication id: 


"UDO_OTS2" 


Authentication pw: 


"Udo_password2" 


Gateway: 




Address: 


"170.187.51.4" 


Type of address: 


"IPv4" 


Port: 


"9203" 


Service: 


"CO-WSP" 


Authentication type: 


"HTTP BASIC" 


Authentication id: 


"gateway_user7" 


Authentication pw: 


"gateway_password7" 
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The UICC is installed into the Terminal and the user has indicated the data stored in EF MMSUCP as default. 

8.3.2.4.2 Procedure 

a) The Terminal is powered on and the PIN shall be entered. 

b) When the Terminal is in idle mode the user shall generate an MM using the MMS User Agent on the Terminal 
with the default MMS User Connectivity Parameters and the MMS user preference information stored in the 
card and send it to "+01 23456789". 



8.3.2.5 



Acceptance criteria 



1) After step b) the Terminal shall have read the first supported set of MMS connectivity parameters stored in EF 
MMSUCP. 

2) After step b) the Terminal shall have sent the MM to "+0123456789" using the MMS User Connectivity 
Parameter set with the highest priority (as defined by its position in EF MMSUCP), which can be used to access 
an available MMS Relay/Server. 

3) After step b) the Terminal shall have sent the MM to "+0123456789" using the MMS user preference 
information stored in EF MMSUP. 

8.3.3 UE recognising the priority order of MMS Issuer Connectivity 
Parameters over the MMS User Connectivity Parameters 



8.3.3.1 



Definition and applicability 



An MMS User Agent should use the MMS related information stored in the USIM, if present, unless otherwise 
specified by the user. This information comprises MMS connectivity information, MMS user preferences and MMS 
notifications. 

MMS user preferences information, which is stored on the USIM, should be used by an MMS User Agent for user 
assistance in preparation of terminal-originated MMs (e.g. default values for parameters that are often used). 
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This test applies to terminals accessing UTRAN, supporting MMS and supporting the usage of MMS related data stored 
on the USIM and when no user MMS connectivity parameters have been selected. 



8.3.3.2 



Conformance requirement 



MMS connectivity information, on the USIM includes a number of sets of MMS connectivity parameters. Some of 
these sets of MMS connectivity parameters are preset by the issuer of the USIM with the first set being the default. 
Such default preset MMS connectivity parameter set shall be selected by a MMS User Agent of a terminal, which 
supports the usage of MMS related data stored on the USIM, unless otherwise specified by the user. 

• TS 31.102 [4], subclauses 4.2.69, 4.7.71, 5.3.30 and 5.3.32; 

• TS 23.140 [23], subclause 6.1.11 and Annex F 



8.3.3.3 



Test purpose 



1) To verify that the Terminal's MMS User Agent uses the MMS connectivity parameter stored on the USIM to 
connect to the network for MMS purposes. 

2) To verify that a MMS Issuer Connectivity Parameter set with lower priority (as defined by its position in EF 
MMSICP) takes precedence over a MMS User Connectivity Parameter set with a higher priority. 



8.3.3.4 



Method of test 



8.3.3.4.1 



Initial conditions 



Four MMS Relays/Servers are available: 
MMS Relay/Server 1: 

- MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay /Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 

Authentication id: 

Authentication pw: 
Gateway 

Address: 

Type of address: 

Port : 

Service: 

Authentication type: 

Authentication id: 

Authentication pw: 



"WAP" 
"http:// mms-operator3.com " 

"GSM-CSD" 

"+49525 1699" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"UDO_OTSl" 

"Udo_passwordl " 

"170.187.51.5" 

"IPv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user9" 

"gateway_password9" 



MMS Relay/Server 2: 
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MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay /Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Call type: 

Delivery of erroneous SDU: 

Residual Bit Error Rate: 

SDU-Error-Ratio: 

Traffic-class: 

Maximum bit rate for downlink: 

Authentication type: 

Authentication id: 

Authentication pw: 
Gateway 

Address: 

Type of address: 

Port : 

Service: 

Authentication type: 

Authentication id: 

Authentication pw: 



"WAP" 

"http:// mms-operator3.com " 

"GSM-GPRS" 

"wap.B2P-operator3.com" 

"APN" 

"ANALOG_MODEM" 

"No" 

"1*10" 5 " 

"1*10 6 " 

"Interactive class" 

"8 kbps" 

"PAP" 

"UDO_OTSl" 

"Udo_passwordl " 

"170.187.51.5" 

"IPv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user9" 

"gateway_password9" 



MMS Relay/Server 3: 

- MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay /Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 

Authentication id: 

Authentication pw: 
Gateway 

Address: 

Type of address: 

Port : 

Service: 

Authentication type: 

Authentication id: 

Authentication pw: 



"WAP" 
"http:// mms-operator3.com " 

"GSM-CSD" 

"+496998626" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"B2C_OTS2" 

"B2C_password2" 

"170.187.51.5" 

"IPv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user9" 

"gateway_password9" 



MMS Relay/Server 4: 
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MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay /Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Call type: 

Delivery of erroneous SDU: 

Residual Bit Error Rate: 

SDU-Error-Ratio: 

Traffic-class: 

Maximum bit rate for downlink: 

Authentication type: 

Authentication id: 

Authentication pw: 
Gateway 

Address: 

Type of address: 

Port : 

Service: 

Authentication type: 

Authentication id: 

Authentication pw: 



"WAP" 

"http:// mms-operator3.com " 

"GSM-GPRS" 

" wap . B2C-operator3 . com" 

"APN" 

"ANALOG_MODEM" 

"No" 

"1*10" 5 " 

"1*10 6 " 

"Interactive class" 

"8 kbps" 

"PAP" 

"B2C_OTS2" 

"B2C_password2" 

"170.187.51.5" 

"IPv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user9" 

"gateway_password9" 



The default UICC is used with the following exceptions: 

EF UST (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 

Fixed dialling numbers available 

Barred dialling numbers available 

The GSM Access available 

The Group Identifier level 1 and level 2 not available 

SMS available 

SMS Status available 

Service no. 33 (Packed Switched Domain) shall be set to T' 

Service no. 52 Multimedia Messaging Service available 

Service no. 55 MMS User Connectivity Parameters available 



Coding: B1 B2 B3 B4 


B5 


B6 


B7 


Binary xx1xxx11 x11xxxxx xxxxIxOO xxxxxlxx 


XXXX XXX 1 


XXXX XXXX 


x1 XX 1 XXX 


EF MMSN 








Logically: 








MMS Status: Free space 








MMS Implementation : "00" 








MMS Notification: "FF FF . . . FF" (25 1 bytes) 








Extension file record number: "FF" 









Coding: B1 
00 



B2 
00 



B3 
00 



B4 
FF 



B5 
FF 



B254 
FF 



B255 
FF 



EF MMSICP 



ETSI 



3GPP TS 31.121 version 4.13.0 Release 4 



132 



ETSI TS 131 121 V4.13.0 (2005-10) 



-,nd 



Logically: 

MMS Connectivity Parameters 
MMS Implementation 

MMS Implementation Information : 
MMS Relay/Server 

MMS Relay/Server Address 
1 st Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 

Authentication id: 

Authentication pw: 

Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 

Authentication id: 

Authentication pw: 
3 ld Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Call type: 

Delivery of erroneous SDU: 

Residual Bit Error Rate: 

SDU-Error-Ratio: 

Traffic-class: 

Maximum bit rate for downlink: 

Authentication type: 

Authentication id: 

Authentication pw: 
4 th Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Call type: 

Delivery of erroneous SDU: 

Residual Bit Error Rate: 

SDU-Error-Ratio: 

Traffic-class: 

Maximum bit rate for downlink: 

Authentication type: 

Authentication id: 

Authentication pw: 
Gateway: 

Address: 

Type of address: 

Port : 

Service: 

Authentication type: 

Authentication id: 

Authentication pw: 



"WAP" 

"http:// mms-operator3.com " 

"GSM-CSD" 

"+496998625" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"B2B_OTSl" 

"B2B_passwordl" 

"GSM-CSD" 

"+496998626" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"B2C_OTS2" 

"B2C_password2" 

"GSM-GPRS" 

"wap.B2B-operator3.com" 

"APN" 

"ANALOG_MODEM" 

"No" 

"1*10" 5 " 

"1*10 6 " 

"Interactive class" 

"8 kbps" 

"PAP" 

"B2B_OTSl" 

"B2B_passwordl" 

"GSM-GPRS" 

"wap.B2C-operator3.com" 

"APN" 

"ANALOG_MODEM" 

"No" 

"1*10" 5 " 

"1*10 6 " 

"Interactive class" 

"8 kbps" 

"PAP" 

"B2C_OTS2" 

"B2C_password2" 

"170.187.51.5" 

"IPv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user9" 

" gate way_pass word9 " 
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EF MMSUP 

























Logically: 

MMS Implementation 

MMS implementation information: "WAP" 

MMS User Preference Profile Name: "Greeting cards" 
MMS User Information Preference Information 

Visibility: "hide" 

Delivery report: "yes" 

Read-reply: "yes" 

Priority: "normal" 

Delivery-Time: 

Value (absolute): " l-Jan-2003, 12:00:00 AM GMT" 

Expiry: 

Value (relative): 1 104537600 seconds 
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EF MMSUCP 
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Logically: 

MMS Connectivity Parameters 
MMS Implementation 

MMS Implementation Information : 
MMS Relay/Server 

MMS Relay/Server Address 
1 st Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 

Authentication id: 

Authentication pw: 

Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 

Authentication id: 

Authentication pw: 
3 ld Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Call type: 

Delivery of erroneous SDU: 

Residual Bit Error Rate: 

SDU-Error-Ratio: 

Traffic-class: 

Maximum bit rate for downlink: 

Authentication type: 

Authentication id: 

Authentication pw: 
4 th Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Call type: 

Delivery of erroneous SDU: 

Residual Bit Error Rate: 

SDU-Error-Ratio: 

Traffic-class: 

Maximum bit rate for downlink: 

Authentication type: 

Authentication id: 

Authentication pw: 
Gateway: 

Address: 

Type of address: 

Port : 

Service: 

Authentication type: 

Authentication id: 

Authentication pw: 



"WAP" 

"http:// mms-operator3.com " 

"GSM-CSD" 

"+49525 1699" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"UDO_OTSl" 

" Udo_password 1 " 

"GSM-CSD" 

"+49525 1700" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"UDO_OTS2" 

"Udo_password2" 

"GSM-GPRS" 
"wap.B2P-operator3.com" 

"APN" 
"ANALOG_MODEM" 

"No" 

"mo" 5 " 

"1*10 6 " 

"Interactive class" 
"8 kbps" 
"PAP" 

"UDO_OTSl" 
" Udo_password 1 " 

"GSM-GPRS" 

"wap.B2C-operator3.com" 

"APN" 

"ANALOG_MODEM" 

"No" 

"mo" 5 " 

"1*10 6 " 

"Interactive class" 
"8 kbps" 
"PAP" 

"UDO_OTS2" 
"Udo_password2" 

"170.187.51.5" 

"IPv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user9" 

" gate way_pass word9 " 
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The UICC is installed into the Terminal and the user hasn't specified a default MMS connectivity parameter set. 

8.3.3.4.2 Procedure 

a) The Terminal is powered on and the PIN shall be entered. 

b) When the Terminal is in idle mode the user shall generate an MM using the MMS User Agent on the Terminal 
with the default MMS connectivity parameter set and send it to "+0123456789". If no MMS Relay/Server is 
available for this parameter set, the next MMS connectivity parameter set offered by the MMS User Agent shall 
be used to send the MM. 



8.3.3.5 



Acceptance criteria 



After step b) the Terminal shall have sent the MM to "+0123456789" using the first supported MMS connectivity 
parameter set, which can be used to access an available MMS Relay/Server and is stored in EF MMSICP. 

8.3.4 Usage of MMS notification 



8.3.4.1 



Definition and applicability 



An MMS User Agent should use the MMS related information stored in the USIM, if present, unless otherwise 
specified by the user. This information comprises MMS connectivity information, MMS user preferences and MMS 
notifications. MMS notifications should be stored on the USIM together with an associated status by a MMS User 
Agent according to TS 23.140 [23]. 

This test applies to terminals accessing UTRAN, supporting MMS notification storage on the USIM. 



8.3.4.2 



Conformance requirement 



A Terminal supporting MMS notification storage on the USIM shall store MMS notifications together with an 
associated status on the USIM. 

• TS 31.102 [4], subclauses 4.2.67 and 5.3.29; 
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• TS 23.140 [23], subclauses 6.1.11 andAnnexF. 

8.3.4.3 Test purpose 

To verify that the Terminal stores and updates MMS notifications with the associated status on the USIM correctly. 



8.3.4.4 



Method of test 



8.3.4.4.1 



Initial conditions 



Two MMS Relays/Servers are available: 
MMS Relay/Server 1: 

MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay /Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 

Authentication id: 

Authentication pw: 
Gateway 

Address: 

Type of address: 

Port: 

Service: 

Authentication type: 

Authentication id: 

Authentication pw: 

MMS Relay/Server 2: 



"WAP" 

"http:// mms -operator 1 .com " 

"GSM-CSD" 

"+496998625" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"B2B_OTSl" 

"B2B_passwordl" 

"170.187.51.3" 

"IPv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_userl" 

"gateway_passwordl " 
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MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay /Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Call type: 

Delivery of erroneous SDU: 

Residual Bit Error Rate: 

SDU-Error-Ratio: 

Traffic-class: 

Maximum bit rate for downlink: 

Authentication type: 

Authentication id: 

Authentication pw: 
Gateway 

Address: 

Type of address: 

Port: 

Service: 

Authentication type: 

Authentication id: 

Authentication pw: 



"WAP" 

"http:// mms -operator 1 .com " 

"GSM-GPRS" 

"wap.B2B-operatorl.com" 

"APN" 

"ANALOG_MODEM" 

"No" 

"1*10" 5 " 

"1*10 6 " 

"Interactive class" 

"8 kbps" 

"PAP" 

"B2B_OTSl" 

"B2B_passwordl" 

"170.187.51.3" 

"IPv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_userl" 

"gateway_passwordl " 



The default UICC is used with the following exceptions: 

EF UST (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 

Fixed dialling numbers available 

Barred dialling numbers available 

The GSM Access available 

The Group Identifier level 1 and level 2 not available 

SMS available 

SMS Status available 

Service no. 33 (Packed Switched Domain) shall be set to T' 

Service no. 52 Multimedia Messaging Service available 

Service no. 53 Extension 8 available 

Service no. 55 MMS User Connectivity Parameters not available 



Coding: B1 B2 B3 B4 


B5 


B6 


B7 


Binary xx1xxx11 x11xxxxx xxxxIxOO xxxxxlxx 


xxxx xxxl 


xxxx xxxx 


x0x1 1xxx 


EF MMSN 








Logically: 








MMS Status: Free space 








MMS Implementation : "00" 








MMS Notification: "FF FF . . . FF" (25 1 bytes) 








Extension file record number: "FF" 









Coding: B1 
00 



B2 
00 



B3 
00 



B4 
FF 



B5 
FF 



B254 
FF 



B255 
FF 



EF MMSUP 
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Logically: 

MMS Implementation 

MMS implementation information: "WAP" 

MMS User Preference Profile Name: "Greeting cards" 
MMS User Information Preference Information 

Visibility: "hide" 

Delivery report: "yes" 

Read-reply: "yes" 

Priority: "normal" 

Delivery-Time: 

Value (absolute): " l-Jan-2003, 12:00:00 AM GMT" 

Expiry: 

Value (relative): 1 104537600 seconds 



Coding: 80 


01 


01 


81 


0E 


47 


72 


65 


65 


74 


69 


6E 


67 


20 


63 


61 


72 


64 


73 


82 


19 


14 


80 


06 


80 


10 


80 


OF 


81 


07 


07 


80 


05 


00 


3E 


12 


2F 


80 


08 


06 


81 


04 


41 


D5 


E8 


00 






EF MMSICP 

























Logically: 

MMS Connectivity Parameters 
MMS Implementation 

MMS Implementation Information : 
MMS Relay/Server 

MMS Relay/Server Address 
1 st Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 

Authentication id: 

Authentication pw: 
2 nd Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 

Authentication id: 

Authentication pw: 
3 ld Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Call type: 

Delivery of erroneous SDU: 

Residual Bit Error Rate: 



"WAP" 

"http:// mms-operatorl .com " 

"GSM-CSD" 

"+496998625" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"B2B_OTSl" 

"B2B_passwordl" 

"GSM-CSD" 

"+496998626" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"B2C_OTS2" 

"B2C_password2" 

"GSM-GPRS" 

"wap.B2B-operatorl .com" 

"APN" 

"ANALOG_MODEM" 

"No" 
"1*10" 5 " 
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SDU-Error-Ratio: 








"1*10 














Traffic-class: 










"Interactive class" 










Maximum bit rate for downlink: 




"8 kbps" 














Authentication type: 








"PAP" 














Authentication id: 








"B2B_OTSl" 












Authentication pw: 








"B2B_passwordl" 










4 th Interface to Core Network and Bearer 
















Bearer: 










"GSM-GPRS" 












Address: 










"wap.B2C-operatorl .com" 








Type 


of address: 








"APN" 














Call type: 










"ANALOG_MODEM" 










Delivery of erroneous SDU: 




"No" 














Residual Bit Error Rate: 






"1*10" 5 " 














SDU-Error-Ratio: 








"1*10 6 " 














Traffic-class: 










"Interactive class" 










Maximum bit rate for downlink: 




"8 kbps" 














Authentication type: 








"PAP" 














Authentication id: 








"B2C_OTS2" 












Authentication pw: 








"B2C_password2" 










Gateway: 


























Address: 










"170.187.51.3" 












Type 


of address: 








"IPv4" 














Port: 












"9201" 














Service: 










"CO-WSP" 












Authentication type: 








"HTTP BASIC" 












Authentication id: 








"gateway 


_userl' 


i 










Authentication pw: 








"gateway_passwordl " 








Coding: AB 


82 


01 


47 


80 


01 


01 


81 


18 


68 


74 


74 




70 


3A 


2F 


2F 


6D 


6D 


73 


2E 


6F 


70 


65 


72 




61 


74 


6F 


72 


31 


2E 


63 


6F 


6D 


82 


2F 


10 




AA 


08 


2B 


34 


39 


36 


39 


39 


38 


36 


32 


35 




00 


09 


87 


25 


C5 


0A 


90 


0C 


9A 


0D 


42 


32 




42 


11 


4F 


54 


53 


31 


00 


0E 


42 


32 


42 


11 




70 


61 


73 


73 


77 


6F 


72 


64 


31 


00 


82 


2F 




10 


AA 


08 


2B 


34 


39 


36 


39 


39 


38 


36 


32 




36 


00 


09 


87 


25 


C5 


0A 


90 


OC 


9A 


0D 


42 




32 


43 


11 


4F 


54 


53 


32 


00 


0E 


42 


32 


43 




11 


70 


61 


73 


73 


77 


6F 


72 


64 


32 


00 


82 




43 


10 


AB 


08 


03 


77 


61 


70 


0D 


42 


32 


42 




2D 


6F 


70 


65 


72 


61 


74 


6F 


72 


31 


03 


63 




6F 


6D 


00 


09 


89 


0A 


90 


31 


03 


37 


70 


38 




06 


33 


60 


36 


08 


0C 


9A 


0D 


42 


32 


42 


11 




4F 


54 


53 


31 


00 


0E 


42 


32 


42 


11 


70 


61 




73 


73 


77 


6F 


72 


64 


31 


00 


82 


43 


10 


AB 




08 


03 


77 


61 


70 


0D 


42 


32 


43 


2D 


6F 


70 




65 


72 


61 


74 


6F 


72 


31 


03 


63 


6F 


6D 


00 




09 


89 


0A 


90 


31 


03 


37 


70 


38 


06 


33 


60 




36 


08 


OC 


9A 


0D 


42 


32 


43 


11 


4F 


54 


53 




32 


00 


0E 


42 


32 


43 


11 


70 


61 


73 


73 


77 




6F 


72 


64 


32 


00 


83 


3C 


20 


31 


37 


30 


2E 




31 


38 


37 


2E 


35 


31 


2E 


33 


00 


21 


85 


23 




39 


32 


30 


31 


00 


24 


CB 


19 


9C 


1A 


67 


61 




74 


65 


77 


61 


79 


11 


75 


73 


65 


72 


31 


00 




1B 


67 


61 


74 


65 


77 


61 


79 


11 


70 


61 


73 




73 


77 


6F 


72 


64 


31 


00 












EF EXT8 



























Logically: 

At least 10 records. 

Record 1 to 10: Free space with 253 bytes for extension data 
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Record 1: 

Coding: 
Hex 



B1 
00 



B2 
FF 



B3 
FF 



B4 
FF 



B255 

FF 



The UICC is installed into the Terminal and the user hasn't specified a default MMS connectivity parameter set. 

8.3.4.4.2 Procedure 

a) The terminal is powered on and the PIN shall be entered. 

b) When the terminal is in idle mode a MM shall be sent to the terminal via the MMS Relay/Server 1 or 2, 
dependent on the bearer supported by the terminal. This MMS Relay/Server shall then generate a notification to 
the Terminal's MMS User Agent. With the MM notification the MMS User Agent shall receive a message 
reference that can be used for retrieving the MM from this MMS Relay/Server. 

The MM shall result in a MMS notification with the following predefined values: 



X-Mms Message Type: 

X-Mms-Transaction-ID: 

X-Mms-MMS-Version: 

From: 

Subject: 

X-Mms-Content-Location: 



"m-notification-ind" (0x82) 

"01" 

"1.0" 

not present (hidden) 

"MM for you" 

"http://mms-operatorl/MMBox/ID-007-12345678" 

c) The user shall read the MMS notification stored on the USIM. 

d) The user shall retrieve the MM stored on the MMS Relay /Server used in step b). 

e) The user shall forward the MM to " +0123456789 " using the default MMS Issuer Connectivity Parameters stored 

on the USIM. 

f) A MM shall be sent to the terminal via the same MMS Relay/Server as in step b). This MMS Relay/Server shall 
then generate a notification to the Terminal's MMS User Agent. With the MM notification the MMS User 
Agent shall receive a message reference that can be used for retrieving the MM from this MMS Relay/Server. 

The MM shall result in a MMS notification with the following predefined values: 

• X-Mms Message Type: "m-notification-ind" (0x82) 

"02" 

"1.0" 

"+0987123654" 

"Urgent MM" 

"http://mms-operatorl/MMBox/ID-007-02468024" 

g) The user shall read the MMS notification stored on the USIM. 

h) The user shall reject the MM stored on the MMS Relay/Server used in step b). 



X-Mms-Transaction-ID: 

X-Mms-MMS-Version: 

From: 

Subject: 

X-Mms-Content-Location: 



8.3.4.5 



Acceptance criteria 



1) After step b) the MMS User Agent on the terminal shall have stored the MMS notification on the USIM with the 
values defined in step b) of 8.4.4.4.2, the associated status shall have been set to "Used space, notification not 
read, MM not retrieved" and the MMS User Agent shall indicate to the user that a MMS notification has been 
received. 
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2) After step c) the status of the MMS notification stored on the USIM shall have been set to "used space, 
notification read, MM not retrieved". 

3) After step d) the MMS user agent shall have retrieved the MM from the MMS Relay/Server 1 and the status of 
the MMS notification stored on the USIM shall have either been set to "used space, notification read, MM 
retrieved" or the MMS notification shall have been deleted and the associated shall have been set to "Free 
space". 

4) After step e) the terminal shall have read the set of MMS Issuer Connectivity Parameters stored first in EF 
MMSICP and shall have forward the MM to " +0123456789 " using the MMS Relay/Server 1. The MMS 
notification shall have either been set to "used space, notification read, MM forwarded" or the MMS notification 
shall have been deleted and the associated shall have been set to "Free space". 

5) After step f) the MMS User Agent on the terminal shall have stored the MMS notification on the USIM with the 
values defined in step f) of 8.4.4.4.2, the associated status shall have been set to "Used space, notification not 
read, MM not retrieved" and the MMS User Agent shall indicate to the user that a MMS notification has been 
received. 

6) After step g) the status of the MMS notification stored on the USIM shall have been set to "used space, 

notification read, MM not retrieved". 

7) After step h) the MMS user agent shall have not retrieved the MM from the MMS Relay/Server 1 and the status 
of the MMS notification stored on the USIM shall have either been set to "used space, notification read, MM 
rejected" or the MMS notification shall have been deleted and the associated shall have been set to "Free space". 
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Annex A (informative); 
Change history 



The table below indicates all change requests that have been incorporated into the present document since it was 
initially approved by 3GPP TSG-T. 



TSG#/ 
Date 


TSG Doc 


Doc 2nd 
level 


CR 


Rev 


Cat 


Subject/Comment 


New 


TP-10 


TP-000205 










Final draft approved at TSG-T #1 


3.0.0 


TP-12 


TP-010108 




001 




F 


Correction of EF(UST) used in the Test USIM 


4.0.0 


TP-010108 




002 




F 


Correction of EF(ECC) used in the Test USIM 


TP-010108 




003 




F 


Correction to EF(HPLMN) regarding test USIMs 


TP-010108 




004 




F 


Deletion of a duplicated test case 


TP-010108 




005 




F 


Modification of EF ECC used in the Test USIM 


TP-16 


TP-020117 




007 




F 


Correction of tests using EF (USIM Service Table) 


4.1.0 


TP-17 


TP-020215 




008 




A 


Correction of coding of EF ACMMax 


4.2.0 






010 




A 


Correction of number of bytes of EF Keys 






012 


1 


A 


Definition of short message 


TP-18 


TP-020286 




015 




A 


Correction of PIN 2 related tests 


4.3.0 






017 




A 


Essential clarifications 






019 




A 


Correction of EF OPLMNwACT 


TP-19 


TP-030028 




021 




A 


File size correction 


4.4.0 






023 




A 


Correction of PLMN coding 


TP-20 


TP-030123 




025 




A 


Correction of acceptance criteria 


4.5.0 


TP-21 


TP-030184 




027 




A 


Usage of 3G PDU definition for UEs accessing UTRAN 


4.6.0 


TP-23 


TP-040028 




029 




F 


CR 31.121 Rel-4: Essential Corrections 


4.7.0 


TP-24 


TP-040338 




031 




A 


Removal of EF RPLMNACT and related tests 


4.8.0 


TP-24 


TP-040340 




033 




A 


Security related tests 


4.8.0 


TP-25 


TP-040184 




040 




F 


Correction of SMS related test cases 


4.9.0 




TP-040184 




038 




A 


Essential Corrections on section 7 


4.9.0 




TP-040184 




043 




B 


Creation of MMS related tests 


4.9.0 




TP-040184 




035 




A 


Alignment with TS 51 .01 0-1 on default EF-ADN 
configuration 


4.9.0 




TP-040184 




036 




F 


Essential Corrections on sections 2-6 


4.9.0 




TP-040184 




042 




A 


Correction of Access Control handling related test case 
TC 5.2.1. 


4.9.0 


TP-26 


TP-040263 




045 




F 


Correction of non specific references 


4.10.0 


TP-27 


TP-050022 


T3-050102 


048 




A 


Correction of Operator controlled PLMN selector 
handling tests 


4.11.0 


TP-27 


TP-050022 


T3-050105 


051 




A 


Correction to the 'Maximum frequency of ACM updating' 
test 


4.11.0 


TP-27 


TP-050022 


T3-050123 


057 




A 


Correction of HPLMN Search Period tests 


4.11.0 


TP-27 


TP-050022 


T3-050156 


054 




A 


Correction of verification of EF PSLOCI in section 7 
"PLMN related tests": 


4.11.0 


CP-28 


CP-050136 


C6-050357 


060 




A 


ISO/IEC 7816-series revision 


4.12.0 


CP-28 


CP-050137 


C6-050360 


063 




A 


Correction of the content for Class 1 short messages in 
TC 8.2.1 


4.12.0 


CP-28 


CP-050137 


C6-050363 


066 




A 


Essential correction of TC 8.1 .2 


4.12.0 


CP-28 


CP-050137 


C6-050430 


070 




A 


Deletion of BDN tests 


4.12.0 


CP-29 


CP-050325 


C6-050656 


078 




A 


Incorrect PUK2 value used in TC 6.1 .6 


4.13.0 


C6-050709 


086 




A 


Incorrect value used for EF SMS in TC 8.2.2 
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